UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

_____________________

FORM 10-K

_____________________

(Mark One)


☒			ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the Fiscal Year Ended December 31, ~~2024~~2025


☐			TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

for the transition period from to

Commission file number: 001-36324

________________________

VARONIS SYSTEMS, INC.

(Exact name of registrant as specified in its charter)

_____________________________


Delaware			57-1222280
(State or other jurisdiction of incorporation or organization)			(I.R.S. Employer Identification No.)

~~1250~~801 ~~Broadway,~~Brickell ~~28th~~Avenue ~~Floor~~

~~New York~~Miami, NYFL ~~10001~~33131

(Address of principal executive offices) (zip code)

Registrant’s telephone number, including area code: (877) 292-8767

Securities registered pursuant to Section 12(b) of the Act:


Title of each class	Trading Symbol(s)	Name of each exchange on which registered
Common Stock, par value $0.001 per share	VRNS	The NASDAQ Stock Market LLC

Securities registered pursuant to Section 12(g) of the Act: None

_____________________________

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.


Large Accelerated Filer	☒	Accelerated Filer	☐

Non-accelerated Filer	☐	Smaller reporting company	☐

		Emerging growth company	☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements

of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of June 30, ~~2024~~2025, the aggregate market value of the registrant's voting and non-voting common equity held by non-affiliates was approximately $5.2556 billion.

As of January 3130, ~~2025~~2026, the registrant had ~~112~~117,~~550~~447,~~156~~726 shares of common stock, par value $0.001 per share, outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Registrant’s Proxy Statement relating to the ~~2025~~2026 Annual Meeting of Stockholders are incorporated by reference into Part III of this Annual Report on Form 10-K.

Special Note Regarding Forward-Looking Statements and Summary Risk Factors

This report contains, and management may make, certain forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). All statements, other than statements of historical facts, may be forward-looking statements. Forward-looking statements are often identified by the use of words such as “anticipate,” “believe,” “can,” “continue,” “could,” “estimate,” “expect,” “intend,” “likely,” “may,” “plan,” “project,” “seek,” “should,” “strategy,” “target,” “will,” “would” and similar expressions or variations intended to identify forward-looking statements. These statements are based on the beliefs and assumptions of our management based on information currently available to management. Such forward-looking statements are subject to risks, uncertainties and other important factors, many of which are difficult to predict and generally beyond our control, that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified in the “Summary Risk Factors” below and those discussed in “Item 1A-Risk Factors” and “Item 7-Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.

The risks that might cause actual results to differ from our expectations include, among other things, those that may be disclosed from time to time in subsequent reports filed with or furnished to the SEC, those described under “Risk Factors” set forth in Item 1A of this Annual Report, and the following, which also summarizes the principal risks of our business:

•the fact that the market for software that analyzes, secures, governs, manages and migrates enterprise data may not continue to grow or grow at the same pace;

•prolonged economic uncertainties or downturns;

•currency exchange rate fluctuations;

•increased competition;

•security breaches, cyberattacks or other cyber-risks and failure to comply with legal requirements, contractual obligations and industry standards regarding security, data protection and privacy;

•our expansion into cloud-delivered services;

•our ability to predict renewal rates and manage growth effectively;

•fluctuation in our quarterly results of operations due to variability in our revenues;

•our limited operating history at our current scale, which makes it difficult to evaluate and predict our future prospects;

•our history of losses;

•our ability to maintain strong relationships with our channel partners, including distributors and resellers, to whom we sell substantially all of our products and services;

•risks inherent in our international operations, including military conflicts that could impact operations, the effect of export and import controls and the risk of a violation or alleged violation of applicable anti-corruption or anti-bribery laws;

•collection and credit risks;

•stock price volatility;

•our ability to maintain or enhance our brand recognition or reputation;

•our ability to retain, attract and recruit highly qualified personnel;

•our dependency on the continued services and performance of our co-founder, Chief Executive Officer and President;

•our ability to continually enhance and improve our technology;

•the fact that, if we experience interruptions or performance problems with our products, or if our software is not perceived as being secure, customers may reduce the use of or stop using our products;

•our ability to protect our proprietary technology and intellectual property rights;

•the fact that our tax rate may vary significantly depending on our stock price;

•our ability to fully utilize our net operating loss carryforwards; and

•our indebtedness~~; and~~.

•stock price volatility.

You should not place undue reliance on forward-looking statements. All forward-looking statements attributable to us or persons acting on our behalf are expressly qualified in their entirety by the foregoing cautionary statements. All such statements speak only as of the date of this Annual Report and, except as required by law, we undertake no obligation to update or revise publicly any forward-looking statements, whether as a result of new information, future events or otherwise.

VARONIS SYSTEMS, INC.

ANNUAL REPORT ON FORM 10-K

For The Fiscal Year Ended December 31, ~~2024~~2025

TABLE OF CONTENTS

		Page
PART I
Item 1	Business	1
Item 1A	Risk Factors	129
Item 1B	Unresolved Staff Comments	3532
Item 1C	Cybersecurity	3533
Item 2	Properties	3634
Item 3	Legal Proceedings	3634
Item 4	Mine Safety Disclosures	3634
PART II
Item 5	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	3835
Item 6	Reserved	4037
Item 7	Management’s Discussion and Analysis of Financial Condition and Results of Operations	4138
Item 7A	Quantitative and Qualitative Disclosures About Market Risk	5451
Item 8	Financial Statements and Supplementary Data	5653
Item 9	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	95
Item 9A	Controls and Procedures	95
Item 9B	Other Information	96
Item 9C	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	96
PART III
Item 10	Directors, Executive Officers and Corporate Governance	97
Item 11	Executive Compensation	97
Item 12	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	97
Item 13	Certain Relationships and Related Transactions, and Director Independence	97
Item 14	Principal Accounting Fees and Services	97
PART IV
Item 15	Exhibits and Financial Statement Schedules	98
Item 16	Form 10-K Summary	98

PART I


Item 1.			Business

We were incorporated under the laws of the State of Delaware on November 3, 2004 and commenced operations on January 1, 2005. Our principal offices are located at ~~1250~~801 ~~Broadway,~~Brickell ~~28th Floor~~Avenue, ~~New York~~Miami, NYFL ~~10001~~33131. For convenience in this report, the terms “Company,” “Varonis,” “we” and “us” may be used to refer to Varonis Systems, Inc. and/or its subsidiaries, except where indicated otherwise. Our telephone number is (877) 292-8767.

Overview

Varonis is a ~~leader~~data insecurity company focused on protecting what matters most to organizations: their data. ~~security~~Modern ~~as,~~enterprises ~~since~~run weon ~~started~~data ~~operations~~that inis ~~2005~~created, wecopied, ~~recognized~~shared ~~that~~and anaccessed ~~enterprise's~~across ~~capacity~~cloud toservices, ~~create~~SaaS applications and ~~share~~on-premises ~~data~~environments, ~~far~~often ~~exceeded~~faster ~~its~~than ~~capacity~~security toteams ~~protect~~can itsee, understand or control. We ~~believed~~started ~~that~~Varonis ~~rapid~~around ~~data~~a ~~growth~~simple ~~combined~~observation ~~with~~that ~~increasing~~we ~~information~~believe ~~dependence~~has ~~would~~only ~~change~~intensified over time: the ~~global~~ability ~~economy~~to create and ~~the~~share ~~risk~~data ~~profiles~~scales offar ~~all~~faster ~~organizations~~than -the ~~from~~ability ~~corporations~~ to ~~governmental~~secure ~~agencies~~it. Our ~~focus~~strategy ~~has~~is ~~been~~built onaround ~~using~~closing ~~innovation~~that togap, ~~address~~giving organizations the ~~cyber-implications~~deep ofvisibility ~~these~~and ~~trends,~~automated ~~creating~~controls ~~software~~to ~~that~~deeply ~~provides~~understand ~~new~~their ~~ways~~enterprise ~~to track~~data, ~~alert~~reduce exposure and ~~protect~~respond ~~data~~to threats quickly, wherever ittheir isdata ~~stored~~lives.

Data ~~continues~~growth toitself ~~grow~~is innot new. ~~and~~What ~~existing~~has ~~data~~changed ~~stores~~is ~~both in~~ the ~~cloud~~combination ~~and~~of ~~on-premises~~scale, asprawl ~~trend~~and wespeed. ~~have~~Cloud ~~seen accelerate as companies worldwide undergo waves of digital~~ transformation and artificial intelligence ("AI") initiatives ~~that~~are ~~have~~pushing ~~significantly~~data ~~impacted~~into ~~how~~more ~~they~~systems, ~~must~~across ~~approach~~more ~~data~~environments ~~security.~~and ~~While~~making ~~the~~it ~~significant~~accessible ~~increase~~to more users, applications and AI agents. As adoption of software-asa-service (“SaaS”) and infrastructure-as-a-service (“IaaS”) ~~usage~~ has accelerated ~~workforce~~ collaboration and ~~information technology ("IT") operations~~productivity, it has also ~~created~~expanded ~~unprecedented~~and fragmented the enterprise data ~~sprawl~~footprint. ~~and~~In ~~complexity~~many ~~that~~organizations, data security controls have ~~contributed~~not tokept apace, ~~growing~~increasing ~~number~~the oflikelihood ~~catastrophic~~that misconfigurations or credential compromise can lead to significant data ~~breaches.~~exposure, threats and regulatory penalties.

We believe the adoption of ~~generative artificial intelligence (“Gen~~ AI”) ~~tools~~materially ~~will~~raises ~~dramatically~~the ~~compound~~stakes ~~data~~for ~~growth~~security and ~~introduce new data security challenges that can only be addressed with automation~~risk. ~~Gen AI-powered productivity features~~Copilots, ~~commonly~~agents ~~called~~and ~~“copilots,”~~automated workflows are now embedded ~~within~~in ~~applications~~widely used enterprise platforms such as Microsoft 365, Salesforce, Google Workspace, and Box and they increasingly act on data at machine speed. These ~~tools~~systems typically ~~leverage~~rely on existing ~~data~~access ~~security~~ controls to determine ~~which~~what ~~sensitive~~data ~~information~~ can be ~~used~~surfaced, bysummarized ~~AI;~~or ifacted anupon. ~~organization’s~~When ~~data~~those ~~security~~ controls are ~~not~~overly ~~optimized~~permissive, ~~they~~poorly ~~face~~understood anand ~~increased~~unmonitored, ~~risk~~AI ofcan ~~unintentional~~unintentionally ~~data~~amplify ~~exposure~~risk ~~and~~by ~~potential~~scaling ~~abuse~~access byfaster ~~malicious~~than ~~actors~~organizations can manage manually. As ~~organizations~~companies customize AI agents ~~(such as Microsoft Copilot Studio~~ and ~~Salesforce Agentforce) and~~ train their own small and large language models ~~("LLMs")~~, we believe ~~additional challenges around~~ the security of ~~training~~ data, ~~models~~identities, agents and ~~the~~ underlying infrastructure will increasingly require automated solutions.

In ~~addition~~this ~~to data growth~~environment, ~~companies~~access ~~face~~becomes ~~an environment where threat actors continue to refine their strategies to monetize sensitive data and~~ the risk ~~of substantial fines for noncompliance with data-centric regulations continues to grow~~multiplier. AtWhen ~~the~~too ~~same~~many ~~time~~people, ~~organizations~~systems ~~are~~or ~~seeing~~automated aagents ~~global~~can ~~scarcity~~reach ofsensitive ~~in-house~~data ~~technical expertise~~ungoverned, assmall ~~the~~incidents ~~demand~~can ~~for~~quickly ~~cybersecurity~~become ~~professionals~~large ~~significantly~~ones. ~~outpaces~~We ~~supply,~~refer ~~and IT and security experts are under pressure~~ to ~~solve~~this ~~growing~~risk ~~problems~~as ~~with~~the ~~fewer~~“blast ~~resources~~radius.” We believe ~~that~~organizations ~~these~~must ~~trends~~continuously ~~provide~~reduce ustheir ~~with~~blast aradius ~~long-term~~– ~~opportunity~~limiting tounnecessary ~~fulfill~~ability ~~our~~to ~~mission~~access, ofmove ~~protecting~~or ~~sensitive~~misuse data ~~for~~– ~~our~~to ~~customers~~reap ~~and alleviating~~ the ~~resource~~tremendous ~~pressure~~benefits ~~and~~of ~~skills~~AI. ~~shortage~~Achieving ~~that~~this ~~companies~~consistently ~~face~~and ~~through~~at ~~our~~scale ~~automation~~isn’t ~~capabilities~~possible ~~and~~through ~~Managed~~manual ~~Data~~processes, ~~Detection~~making ~~and~~automation ~~Response ("MDDR") offering~~essential.

~~Enterprises~~At ~~now~~the ~~use~~same ~~many different combinations of data stores and applications~~time, ~~making~~threat itactors ~~difficult~~continue to ~~holistically~~refine ~~visualize,~~their ~~quantify~~methods ~~and~~of ~~control~~monetizing ~~data~~sensitive ~~breach risk without a unified~~ data, ~~security~~and ~~platform.~~regulatory Weexpectations ~~believe~~around ~~our~~privacy, ~~offering's comprehensive~~ data ~~coverage~~protection, and ~~automation~~AI ~~allows~~governance ~~organizations~~continue to ~~keep pace with the relentless data growth, sprawl and complexity~~evolve. WeMany ~~started~~organizations inare ~~2005~~also ~~with~~operating ~~coverage~~under ~~for~~real ~~Windows~~constraints ~~file~~– ~~shares.~~the ~~Today,~~demand ~~we offer coverage~~ for ~~most~~skilled ~~mission-critical~~security ~~cloud~~professionals ~~and~~continues ~~on-premises~~to ~~data~~exceed ~~stores~~supply, ~~cloud infrastructure environments, identity repositories~~ and ~~many~~teams ~~critical~~are ~~SaaS~~expected ~~applications. In 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS, which offers simpler deployment, faster time-~~to~~-value,~~ ~~and~~manage ~~groundbreaking~~growing ~~automation~~complexity ~~capabilities~~with ~~that~~limited ~~help customers prevent data breaches~~resources. ~~Since~~We ~~that~~believe ~~time,~~these wepressures ~~have~~will ~~seen SaaS deployments grow significantly and expect them to~~ continue to ~~increase~~drive ~~through~~adoption ~~2025,~~of ~~when~~automated weapproaches ~~believe~~that ~~our~~reduce ~~transition~~data toexposure aby ~~SaaS~~default ~~delivery~~and ~~model~~enable tofaster bedetection ~~complete~~and response.

~~Varonis~~Enterprises ~~software~~today ~~enables~~rely ~~enterprises~~on many combinations of ~~all~~data ~~sizes~~stores, cloud services and ~~industries~~SaaS applications, making it difficult to ~~protect~~understand data ~~stored~~exposure inholistically ~~the~~or ~~cloud~~control ~~and~~breach ~~on-premises,~~risk ~~including:~~without ~~sensitive~~a ~~files,~~unified ~~emails~~approach. ~~and~~We ~~databases;~~believe ~~confidential~~comprehensive ~~personal~~coverage ~~data~~and ~~belonging~~automation are required to ~~customers,~~keep ~~patients~~pace with the scale and ~~employees;~~complexity ~~financial~~of ~~records;~~modern ~~source~~data ~~code,~~environments. ~~strategic~~Our ~~and~~platform ~~product~~has ~~plans;~~expanded ~~and~~from ~~other~~an ~~intellectual~~initial ~~property.~~focus ~~Recognizing~~on ~~the~~Windows ~~challenge~~files shares to cover a broad range of ~~protecting~~mission-critical cloud and on-premises data ~~with~~stores, ~~growing~~cloud ~~volume~~infrastructure environments, ~~velocity~~identity repositories, and ~~variety~~key SaaS and AI applications. In 2022, we ~~have~~introduced ~~built~~the anVaronis ~~integrated~~Data ~~platform~~Security toPlatform ~~simplify~~as ~~and~~a ~~streamline~~SaaS ~~data~~offering ~~security~~to simplify deployment, ~~threat~~accelerate ~~detection~~time-to-value, and ~~response~~enable ~~and~~continuous ~~data~~cloud-delivered ~~privacy~~automation ~~and~~for ~~compliance~~protecting data.

~~The~~ Varonis ~~Data~~software ~~Security~~helps ~~Platform~~organizations ~~helps~~of ~~enterprises~~all sizes and industries protect sensitive data ~~against~~stored ~~cyberattacks~~in ~~from~~the ~~both~~cloud ~~external~~ and ~~internal~~on-premises, ~~threats.~~including: ~~Our~~files, ~~technology~~emails ~~enables~~and ~~enterprises~~databases, toconfidential ~~analyze~~personal data, ~~application~~financial records, source code, strategic and ~~account~~product ~~activity~~plans, and ~~user~~other ~~behavior~~intellectual toproperty. ~~help~~As ~~detect~~the volume, velocity and ~~prevent~~variety ~~attacks.~~of ~~Varonis~~enterprise ~~prevents~~data orcontinues ~~limits~~to ~~unauthorized~~grow, ~~use~~we ofhave ~~sensitive~~built ~~information~~an integrated platform designed to simplify and streamline data security, ~~detects~~threat detection and ~~prevents~~response, ~~potential~~and privacy and compliance workflows.

Platform and Technology

~~cyberattacks~~Our ~~and~~platform ~~limits~~is ~~potential~~designed ~~damage~~around bya ~~automatically~~core ~~locking~~belief: ~~down~~in modern data environments, ~~allowing~~security outcomes are determined less by perimeter controls and more by how much access toexists ~~only~~when ~~those~~something ~~who~~goes ~~need~~wrong. itAs data spreads across cloud services, SaaS applications and ~~automating~~on-premises ~~the~~systems ~~removal~~– ofand ~~stale~~as humans, services and AI agents interact with that data ~~when~~at itincreasing isspeed no– ~~longer~~manual ~~useful~~approaches to security do not scale. We believe reducing unnecessary access to sensitive data and automatically responding to abnormal behavior are essential to limiting the impact of inevitable failures.

~~The~~At the foundation of the Varonis Data Security Platform is ~~driven~~our byability ato ~~proprietary~~understand ~~technology,~~data ~~our~~in ~~Metadata~~context. ~~Framework~~Our proprietary technology, ~~that~~continuously ~~extracts~~collects ~~critical~~and analyzes metadata, or– data about data, ~~from~~– across an ~~enterprise~~organizations' environments. We understand what types of data exists, where it lives, who can access it and how it’s ITbeing ~~infrastructure~~used. ~~Our~~This ~~platform~~contextual ~~uses~~view ~~this~~allows ~~contextual~~us ~~information~~ to map ~~functional~~ relationships among ~~employees~~users, ~~data objects~~devices, ~~systems~~applications, ~~content~~automated agents and ~~usage.~~data ~~In doing so~~objects, ~~our~~creating ~~platform~~a ~~provides~~durable ~~real-time~~model ~~intelligence~~of ~~about~~the ~~an enterprise~~organization’s ~~massive volumes of~~ data, ~~making~~exposure iteven ~~more~~as ~~secure,~~environments ~~accessible and manageable~~change.

WeThis ~~believe~~metadata-driven ~~that~~approach ~~the~~enables ~~(i)~~our ~~Varonis~~platform ~~Data~~to ~~Security~~operate ~~Platform~~at ~~technology,~~enterprise ~~(ii)~~scale ~~coverage~~with ~~for~~minimal ~~most~~impact ~~mission-critical cloud and~~ on~~-premises~~ ~~data~~production ~~stores~~systems. ~~and~~Rather ~~cloud~~than ~~infrastructure~~relying ~~environments,~~on ~~identity~~static ~~repositories~~rules ~~and~~or ~~many~~periodic ~~critical~~scans, ~~SaaS~~the ~~applications~~platform ~~and~~continuously ~~(iii)~~normalizes ~~technical~~metadata ~~experts~~from ~~within~~disparate ~~the~~sources, ~~Company~~making ~~who~~it ~~continue~~actionable toacross ~~expand~~hybrid and ~~improve~~multi-cloud ~~our~~environments. ~~offering~~We ~~are~~believe ~~our~~this ~~primary~~persistent, ~~hard~~contextual tounderstanding ~~replicate competitive advantages. The strength~~ of ~~our~~data ~~solution~~ is ~~driven~~critical byto ~~several~~enabling ~~proprietary~~productivity ~~technologies~~ and ~~methodologies~~AI adoption that weis ~~have~~effective ~~developed,~~and ~~coupled with how we have combined them into our highly versatile platform~~safe. ~~Our belief in our technological advantage stems from having developed a way to do each of the following:~~

~~•analyze~~Building on this foundation, the ~~relationships~~Varonis ~~between~~Data ~~users~~Security Platform is designed to automate outcomes across data protection, threat detection and response, and privacy and compliance. The platform continuously discovers and classifies well-defined sensitive data ~~with~~like ~~sophisticated~~credit ~~algorithms~~card numbers, ~~including~~SSNs ~~cluster~~and ~~analyses~~patient IDs, and uses machine learning; and AI to identify novel domain- and organization-specific data such as recipes, contracts, formulas and other intellectual property. Beyond understanding the data estate, Varonis identifies excessive or risky access and automatically remediates exposure by right-sizing permissions and removing outdated or unnecessary access. By reducing the amount of data that users, systems and automated agents can reach, the platform helps organizations move toward a least-agency model that limits the potential blast radius of an incident without disrupting everyday business operations.

~~•visualize~~The same model is used to detect and ~~depict~~respond ~~the~~to ~~analyses~~threats. inBy ananalyzing ~~intuitive~~data ~~manner,~~access ~~including~~patterns ~~simulating~~– ~~contemplated~~user ~~changes~~and entity behavior and ~~automatically~~system ~~executing~~activity ~~tasks~~together – the platform can identify suspicious behavior that could be compromised credentials, insider misuse, malware or ransomware. When threats are ~~becoming~~detected, ~~increasingly~~the ~~more~~platform ~~complex~~can ~~for~~automatically ITtake action to contain it such as restricting access or locking down affected accounts, limiting potential damage and ~~business~~reducing ~~personnel;~~recovery time.

~~•identify~~The ~~and~~Varonis ~~automatically~~platform ~~classify~~is ~~data~~offered as ~~sensitive~~a SaaS offering, ~~critical~~which we believe is key to our ability to deliver these outcomes at scale. SaaS delivery allows customers to deploy quickly, ~~private~~reduce orinfrastructure ~~regulated~~and operational overhead, and benefit from continuous updates to ~~help~~threat ~~organizations~~models, ~~ensure~~automation ~~compliance~~workflows ~~with~~and ~~regulations~~security capabilities, including ~~the~~our ~~General~~Managed Data ~~Protection~~Detection ~~Regulation~~and Response (~~"GDPR"~~“MDDR”) ~~and~~offering, ~~the~~which ~~California~~are ~~Consumer~~only ~~Privacy~~available ~~Act~~through ~~("CCPA");~~our SaaS platform.

~~•automate~~We ~~remediation~~have further expanded the platform’s capabilities with the introduction of ~~excessive~~Athena ~~access~~AI, a generative AI layer designed to ~~sensitive~~enhance ~~information~~security ~~across~~operations rather than replace human judgement. Athena AI combines small and large language models with the platform’s deep understanding of data, ~~stores~~identities, and ~~cloud~~prior ~~applications~~incidents to ~~safely~~help ~~ensure~~security ateams ~~Zero~~with ~~Trust~~investigation, orresponse ~~least~~and ~~privilege~~reporting. ~~model;~~By enabling natural-language interaction and generating tailored response guidance, Athena AI helps teams act more quickly and effectively without requiring specialized expertise.

~~•profile~~Our ~~users~~platform architecture is designed to be extensible. We continue to expand coverage across additional data stores, ~~devices~~cloud services, and SaaS applications. We enhance functionality both organically and through strategic acquisitions. Our recent acquisition of Cyral, Inc. ("Cyral") enhanced our data security offering with database activity monitoring capabilities. We also acquired SlashNext, Inc. ("SlashNext"), an AI-based email security technology that gives Varonis the ability to detect ~~suspicious~~and ~~account~~block ~~behavior~~modern ~~and~~social-engineering ~~unusual~~attacks ~~file~~across ~~and~~multiple ~~email~~communication ~~activity~~channels. ~~using~~We ~~deep~~believe ~~analysis~~this ofapproach ~~metadata~~allows customers to consolidate security capabilities onto a single platform while giving us a framework to address emerging risks, ~~machine~~including ~~learning~~those introduced by AI-driven systems, new data types, and ~~user~~evolving ~~behavior~~regulatory ~~analytics;~~requirements.

~~•profile~~SaaS ~~cloud~~Delivery ~~configurations and interconnectivity to identify potential exposure and abuse;~~Model

~~•generate~~Our ~~meaningful,~~platform ~~actionable~~is ~~alerts~~designed ~~when~~to deliver security~~-related~~ ~~incidents~~outcomes ~~are~~at ~~detected;~~scale without requiring proportional increases in customer effort or staffing. By automating discovery, classification, access reduction and response, customers can reduce risk across large and complex data environments without relying on manual processes that do not scale.

~~•enable~~The ~~security~~SaaS ~~teams~~delivery tomodel ~~investigate~~supports this approach by enabling rapid deployment, continuous updates and ~~respond~~lower tooperational ~~cyber~~overhead. ~~threats~~Customers ~~more~~can ~~quickly~~begin assessing risk and ~~conclusively~~reducing ~~with~~exposure ~~the~~quickly, ~~help~~while ofbenefiting ~~Gen~~from ~~AI;~~ongoing improvements to detection models, automation workflows and new capabilities delivered through the platform.

•automatically respond to severe incidents, such as ransomware, to limit the potential impact and reduce recovery times;

•provide customers live updates to our platform, which address the rapidly evolving threats they face;

•determine relevant metadata and security information to capture without impacting the enterprise's computing and network infrastructure;

•modify and enrich that metadata in a way that makes it comparable and analyzable despite it having originated from disparate IT systems, and create supplemental metadata, as needed, when the existing IT infrastructure’s activity logs are insufficient;

•decipher the key functional relationships of metadata, the underlying data, and its creators; and

•use those functional relationships to create a graphical depiction, or map, of the data that will endure as enterprises continuously add large volumes of data to their network and storage resources.

The broad applicability of our technology has resulted in our customers deploying our software for numerous use cases. These use cases include: automatic discovery and classification of high-risk, sensitive data; data security posture management; SaaS security posture management; automated remediation of over-exposed data; centralized visibility and risk analysis of enterprise data and monitoring of user behavior and file activity; security monitoring and risk reduction; data breach, insider threat, malware and ransomware detection with MDDR; automatic response to ransomware and other severe incidents to limit exposure and reduce recovery times; data ownership identification, assignment, and automatic involvement; forensics, reporting

~~and~~As ~~auditing~~part ~~with~~of ~~searchable~~our ~~logs;~~strategic ~~meeting~~transition ~~security~~to ~~policy~~SaaS, ~~and~~we ~~compliance~~have ~~regulation;~~announced ~~automatic~~the ~~data~~end-of-life ~~migration; cloud migration; automation~~ of ~~retention~~our ~~and~~self-hosted ~~disposition~~products ~~policies;~~as ~~automatic~~of ~~data~~December ~~quarantine;~~31, ~~intelligent archiving; and automated indexing for data subject requests related to privacy and compliance requirements~~2026.

We sell substantially all our products and services to channel partners, including distributors and resellers, which sell to end-user customers, whom we refer to in this report as our customers. Our products are also available to trial and purchase via the Azure Marketplace, AWS Marketplace, and Salesforce AppExchange. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and successfully deliver our unique value proposition for securing enterprise data. While our products serve customers of all sizes, across all industries and all geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors. We believe our existing customer base is a strong source of future incremental revenues given our broad platform of products, the growing volumes and complexity of their enterprise data and the associated security concerns.

Size of Our Market Opportunity

The International Data Corporation’s Global DataSphere Forecast, ~~2024~~2025-~~2028~~2029, predicts that over the next five years, data will ~~reach~~grow ~~approximately~~at ~~394~~a ~~zettabytes~~compound ~~(or~~annual ~~394~~growth ~~trillion~~rate ~~Gigabytes)~~of by25.4% ~~2028,~~to ~~representing~~reach amore ~~nearly~~than ~~10x~~527 ~~increase~~zettabytes ~~compared~~(or to527 ~~2018~~trillion Gigabytes) by 2029. That data will include both structured and unstructured data, but unstructured data overwhelmingly dominates, accounting for approximately 90% of the data created each year. We expect this significant growth to continue creating a need for automation technologies to protect and manage data. We believe that the diverse coverage and functionality offered by our platform positions us well to capitalize on this powerful trend in the digital universe.

~~Our~~Growth ~~Technology~~Strategy

Our ~~proprietary~~objective ~~technology~~is ~~extracts critical information about an enterprise’s data and its supporting infrastructure, and uses this contextual information, or metadata,~~ to ~~create~~be athe ~~functional~~primary ~~map~~platform ofenterprises anrely ~~enterprise’s~~on ~~data and underlying file systems. Our Metadata Framework technology has been architected~~ to ~~process~~protect ~~large~~their ~~volumes~~most ofsensitive ~~enterprise~~ data ~~and related metadata at a massive scale with minimal demands on the existing IT infrastructure~~. AtWe ~~the~~believe ~~end of 2022, Varonis announced~~ the ~~availability~~combination of ~~our~~accelerating ~~flagship~~data ~~Varonis Data Security Platform as a SaaS. The benefits of SaaS delivery are widely established for both customers and providers~~growth, ~~and~~expanding weuse ~~believe this evolution~~ of a SaaS ~~delivery option for the Varonis Data Security Platform is transformational for several reasons: customers are able to more quickly~~ and ~~easily~~cloud ~~deploy and maintain our solutions with reduced~~ infrastructure, and ~~personnel~~the ~~requirements;~~adoption ~~a lower total cost~~ of ~~ownership;~~AI-driven ~~faster~~systems ~~deployment~~creates ofa ~~risk assessments~~durable, ~~which~~long-term isopportunity ~~the core of our sales motion; enhanced threat detection; continual threat model updates; increased automation~~ for ~~securing~~automated data insecurity. ~~place;~~Our ~~and~~growth ~~the~~strategy ~~ability~~is tofocused ~~deliver~~on ~~additional~~scaling ~~features~~a ~~and~~unified ~~functionality~~platform tothat ~~customers~~reduces ~~more~~data ~~efficiently. In addition~~exposure, ~~our~~limits ~~MDDR offering further reduces both~~ the ~~likelihood~~impact of aincidents ~~breach~~ and ~~its~~enables ~~potential~~customers ~~impact by enabling automated 24x7x365 monitoring with a service level agreement ("SLA") that ensures Varonis will respond~~ to ~~alerts~~operate ~~within~~securely aas ~~specified~~their ~~time~~environments ~~frame.~~become ~~Our~~more ~~MDDR offering is only available for our SaaS customers because of the automation and visibility that’s built into our SaaS platform~~complex.

OnExtend ~~November~~the ~~14,~~Platform ~~2023,~~Through weInnovation ~~announced an expansion of our AI~~ and ~~machine~~Strategic ~~learning~~Transactions. ~~capabilities~~We ~~with~~intend ~~the~~to ~~launch~~continue ofinvesting ~~Athena~~in ~~AI,~~product adevelopment ~~new~~to ~~Gen~~expand AIthe ~~layer~~capabilities ~~within~~of the Varonis Data Security Platform. ~~The~~and ~~initial~~address ~~functionality~~new ~~provided~~use bycases ~~Athena~~from AIchanges ~~includes~~in ~~(i)~~how andata ~~AI-powered~~is ~~security~~created, ~~operations~~accessed ~~center~~and ~~(SOC)~~used. ~~analyst~~Our ~~that~~platform ~~combines~~architecture ~~LLMs~~allows ~~with~~us ~~Varonis'~~to ~~unique~~add ~~context~~coverage ~~about~~across anadditional ~~organization's~~ data, ~~identities~~stores, ~~devices~~cloud ~~and~~services ~~previous alerts to instantly generate tailored alert response playbooks~~ and ~~recommendations~~SaaS ~~and~~applications, ~~(ii)~~as awell ~~natural~~as ~~language~~introduce ~~search~~new ~~interface~~automation ~~that lets users run reports, perform risk analysis~~ and ~~conduct~~response ~~security~~capabilities ~~investigations~~ without ~~any~~requiring ~~domain-specific~~customers ~~knowledge~~to ordeploy ~~product~~separate ~~expertise~~point solutions.

~~Key~~In ~~Benefits~~addition ofto ~~Our~~organic ~~Technology~~innovation, we selectively pursue strategic acquisitions that extend our platform or accelerate entry into adjacent markets where we believe automation and context provide a competitive advantage. We focus on technologies that can be integrated into our platform to enhance data visibility, reduce exposure and improve detection and response outcomes, including recent additions in database activity monitoring and email security. We believe this disciplined approach allows us to expand functionality while maintaining a unified operating model.

Grow Adoption Within Existing Customers. We believe our ~~transition~~existing tocustomer ~~SaaS~~base ~~enhances~~represents ~~many~~a ofsignificant ~~the~~opportunity ~~benefits~~for ~~described~~continued ~~below~~growth. ~~and~~As ~~allows~~customer usenvironments toevolve, ~~deliver~~data ~~additional~~volumes ~~benefits~~increase toand ~~customers~~AI-driven ~~that~~workflows ~~our~~expand, ~~cloud~~organizations ~~technology~~typically ~~unlocks.~~extend ~~Varonis~~data ~~has~~security ~~better~~controls ~~visibility~~to ~~into~~additional ~~customer~~systems ~~usage, issues,~~ and ~~behaviors~~use ~~that~~cases. ~~better~~Our ~~inform~~platform ~~our~~is ~~innovation;~~designed ~~customers~~to ~~seamlessly~~scale ~~benefit~~with ~~from~~customer ~~continual~~needs, ~~threat~~enabling ~~model~~broader ~~updates~~adoption ~~that~~across ~~help~~data ~~them~~stores, ~~stay~~applications ~~ahead~~and ofenvironments ~~evolving~~over ~~threats;~~time. ~~and~~Our ~~the~~renewal ~~SaaS~~rate ~~model~~for ~~allows~~the usyear toended ~~deliver~~December ~~additional~~31, ~~features~~2025 ~~and~~continued ~~functionality~~ to ~~customers~~be ~~more~~over ~~efficiently.~~90%,

~~Automated~~We ~~Data~~expect ~~Security~~increased adoption to be driven by customers consolidating security capabilities onto a single platform. By delivering ongoing improvements through our platform and focusing on risk reduction outcomes, we aim to deepen customer relationships and maintain high renewal rates.

Acquire New Customers Through Platform-Led Expansion.. We continue to target new customers across industries and geographies that face growing data security, compliance and operational challenges. While our platform is built to support organizations of all sizes, we remain focused on larger enterprises that can benefit most from automation at scale.

Our go-to-market approach combines a global network of channel partners with a highly trained sales organization that engages customers through risk assessments and platform demonstrations. We believe this model creates efficiencies in customer acquisition while clearly articulating the value of reducing data exposure and limiting incident impact.

Scale SaaS, Automation, and Managed Services. The transition to a SaaS delivery model is central to our growth strategy. SaaS delivery enables faster deployment, continuous improvement and increased automation, while also supporting recurring revenue and operational leverage. It also provides the foundation for advanced capabilities including our MDDR offering, which delivers 24x7x365 monitoring and response backed by service-level commitments.

~~Comprehensive~~We ~~Solution~~believe demand for ~~Managing~~managed and ~~Protecting~~automated ~~Enterprise Data. Our products enable a broad range of functionality, including AI~~ security, ~~data~~outcomes ~~governance,~~will ~~least~~continue ~~privilege~~to ~~and~~increase ~~Zero Trust,~~ as ~~well~~organizations asseek ~~intelligent~~to ~~retention.~~operate ~~Moreover,~~securely ~~our~~with ~~solution~~constrained isinternal ~~applicable~~resources. ~~across~~By ~~most~~combining ~~major~~platform ~~enterprise~~automation ~~data~~with ~~stores,~~expert-led ~~cloud infrastructure environments and SaaS applications (Windows~~response, ~~UNIX/Linux,~~we ~~Intranets,~~aim ~~email~~to ~~systems,~~help ~~Microsoft~~customers ~~365,~~reduce ~~including~~risk ~~SharePoint Online, Teams~~ and ~~OneDrive~~simplify ~~for Business, Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases)~~operations.

~~Actionable~~Expand ~~Insight~~Internationally and ~~Automation.~~Establish ~~Our~~Platform ~~products~~Leadership. ~~help~~We ~~customers~~believe ~~identify~~there ~~and~~is ~~prioritize~~a ~~risks~~significant opportunity to ~~their~~expand ~~data~~adoption ~~and~~of ~~automatically~~our ~~remediate~~platform ~~exposures~~internationally soas ~~that~~data ~~they are less vulnerable to internal and external threats~~protection, ~~more~~privacy ~~compliant~~ and ~~consistently~~security ~~follow~~requirements abecome ~~least~~increasingly ~~privilege model~~global. ~~Because~~We ofcontinue ~~the~~to ~~complexity~~invest ~~present~~ in ~~even~~international ~~modest~~sales, ~~enterprises~~marketing, weand ~~believe~~partner ~~that~~relationships ~~effective~~to ~~remediation~~support isthis ~~impossible at scale without intelligent automation~~expansion.

~~Visibility~~We ~~and~~also ~~Data~~work ~~Monitoring~~closely ~~Capabilities~~with ~~All~~leading incloud ~~One~~services ~~Place.~~providers, ~~Our~~storage ~~solution~~vendors ~~combines~~and ~~analysis~~SaaS ~~from~~platforms ~~disparate~~to ~~on-premises~~ensure compatibility and ~~cloud~~integration ~~stores,~~across ~~applications~~the ~~and~~enterprise ~~infrastructure~~ecosystem. ~~environments~~We ~~and~~believe ~~presents~~these ~~them~~relationships, incombined awith ~~single~~our ~~view~~broad coverage and automation capabilities, ~~even~~position asthe ~~data~~Varonis ~~storage~~Data ~~and~~Security ~~user~~Platform ~~access~~to become ~~more~~a ~~dispersed~~standard ~~and~~foundation ~~complex~~for inenterprise ~~hybrid~~data ~~environments~~security.

Fast Time-to-Value and Low Total Cost of Ownership. Our solutions do not require custom implementations or long deployment cycles. Our software can be deployed in under an hour and allows customers to realize real value with minimal effort. Our SaaS architecture enables customers to protect petabyte-scale data environments with little to no infrastructure costs and by leveraging our automation capabilities and MDDR service, customers can significantly reduce their personnel expenses.Competition

~~Ease~~The ofmarkets ~~Use.~~in ~~While~~which we ~~utilize~~operate ~~complex~~are ~~data~~competitive ~~structures~~ and ~~algorithms~~evolving. inEnterprises ~~our~~address data ~~engine~~security, weprivacy ~~abstract~~and ~~that~~threat ~~complexity~~detection tothrough ~~provide~~ a ~~sleek~~combination of internal processes and software solutions, ~~intuitive~~including ~~interface~~point products designed to address specific use cases. ~~Our~~While ~~software~~some isvendors ~~accessible~~offer ~~through~~functionality athat ~~standard~~overlaps ~~web~~with ~~browser~~individual ~~and~~components ~~requires~~of ~~limited~~our ~~training~~platform, ~~saving~~we ~~time~~believe ~~and~~the ~~cost~~competitive ~~and~~landscape ~~making~~is itincreasingly ~~accessible~~shaped toby adifferences ~~broader~~in ~~set~~approach, ofrather ~~users~~than by any single feature.

~~Highly~~Many ~~Scalable~~organizations ~~and~~have ~~Flexible~~historically ~~Data~~addressed ~~Engine.~~data ~~Our~~security ~~metadata~~through ~~analysis~~fragmented ~~technology~~tools isfocused ~~built~~on tovisibility, beclassification ~~highly~~or ~~scalable,~~monitoring ~~allowing~~within ~~our~~isolated ~~customers~~environments. toWe ~~analyze~~believe ~~vast~~this ~~amounts~~approach ofis ~~enterprise~~insufficient as data. ~~Moreover~~becomes more distributed across cloud services, ~~our~~SaaS ~~proprietary~~applications, ~~platform~~and on-premises systems, and as access is ~~built~~granted ~~with~~not aonly ~~flexible,~~to ~~modern~~users ~~cloud~~but ~~architecture~~also to services and automated agents. In this environment, ~~allowing~~the ~~customers~~ability to ~~expand~~understand ~~their~~ data ~~coverage~~in ~~seamlessly~~context and ~~transparently~~reduce ~~without~~unnecessary ~~impacting~~access ~~performance~~at scale becomes a critical differentiator.

~~Threat~~We ~~Detection~~compete with a range of vendors that provide standalone or partially integrated solutions across areas such as data security posture management, data discovery and ~~Response~~classification, data privacy, directory and identity security, and threat detection and response. We also face competition from broader security platforms that offer adjacent capabilities. In addition, large cloud providers and SaaS vendors continue to expand native security features within their platforms.

~~Threat~~We ~~Detection~~believe ~~and~~our ~~Response~~competitive ~~with~~position ~~User,~~is ~~Data~~strengthened ~~and~~by ~~System~~the ~~Context.~~breadth ~~Our~~of ~~solutions~~environments ~~combine~~we ~~classification~~support and ~~data~~by ~~access~~our ~~governance~~ability ~~with~~to ~~User~~deliver ~~and~~automated ~~Entity~~outcomes ~~Behavior~~across ~~Analytics ("UEBA") on~~ data ~~stores~~security, ~~cloud~~threat ~~applications,~~detection ~~identity repositories~~ and ~~perimeter devices~~response, ~~including~~and ~~Domain~~privacy ~~Name~~and ~~System~~compliance ~~("DNS"),~~within ~~Virtual~~a ~~Private~~single ~~Network~~platform. ~~("VPN")~~Our ~~and~~approach ~~web~~is ~~proxy,~~designed ~~for~~to ~~accurate~~reduce ~~detection~~data ~~and~~exposure ~~risk~~proactively, ~~reduction.~~limit ~~Our~~the ~~solutions~~potential ~~reduce~~impact ~~risk~~of ~~relating~~incidents toand ~~unauthorized~~respond ~~use~~quickly ~~and~~when ~~cyberattacks~~threats ~~and~~occur, ~~reduce~~rather ~~incident~~than ~~time~~relying toprimarily ~~detection~~on ~~(TTD)~~alerts and ~~time~~manual ~~to resolution (TTR)~~intervention.

~~Protect~~As ~~Data~~organizations ~~from~~increasingly ~~Insider~~adopt ~~Threats~~SaaS, ~~Data~~cloud ~~Breaches~~infrastructure, ~~Malware~~ and ~~Cyberattacks.~~AI-driven ~~Our solutions analyze how employee accounts~~systems, ~~service~~we ~~accounts~~believe ~~and~~the ~~admin~~limitations ~~accounts~~of ~~use and access data~~manual, ~~profile~~rules-based ~~employees’~~and ~~roles~~alert-centric ~~and~~security ~~file~~models ~~contents,~~become ~~baseline~~more ~~“normal”~~apparent. ~~behavior~~Solutions ~~patterns,~~that ~~and~~depend ~~alert~~heavily on ~~significant~~customer ~~deviations~~configuration, ~~from~~tuning ~~profiled~~and ~~behaviors.~~ongoing ~~Our~~human ~~customers~~oversight ~~can~~may ~~detect~~struggle ~~advanced~~to ~~persistent~~scale ~~threats~~as ~~("APTs"),~~environments ~~cybercriminals,~~grow ~~rogue~~in ~~insiders,~~size ~~attackers~~and ~~that~~complexity. ~~have~~We ~~compromised~~believe ~~internal~~automation ~~systems~~will ~~and~~become ~~employee~~an ~~accounts,~~essential ~~malware,~~requirement ~~ransomware~~for ~~and~~effective ~~other~~data ~~significant threats~~security.

~~Managed~~Competition ~~Data~~in ~~Detection~~our ~~and~~markets ~~Response.~~is ~~Under~~influenced aby ~~SaaS~~several ~~delivery~~factors ~~model,~~including the ~~Varonis~~effectiveness ~~incident response~~ and ~~forensics~~reliability ~~teams~~of ~~can review~~solutions, ~~triage,~~the ~~and~~breadth ~~proactively notify customers~~ of ~~any~~support ~~incidents that require their attention. Because Varonis centrally monitors a wide array of customer~~ environments, wescalability, ~~can~~ease ~~spot~~of ~~patterns~~deployment ~~across tenants~~ and ~~take~~the ~~action~~ability to ~~prevent~~deliver ~~data~~measurable ~~breaches~~risk ~~and~~reduction. ~~analyze~~We ~~our~~believe ~~security~~we ~~team's~~compete ~~actions~~favorably toacross ~~continually~~these ~~extend our automated capabilities. In 2023~~areas, ~~we introduced Proactive Incident Response~~however, asome ~~complementary~~competitors ~~service~~may ~~included~~have ingreater ~~customers'~~resources, ~~Varonis~~longer ~~SaaS~~operating ~~subscription.~~histories, Webroader ~~expanded~~brand ~~upon~~recognition ~~this~~or ~~offering~~deeper inrelationships ~~early~~with ~~2024~~certain bycustomers ~~introducing~~and ~~MDDR~~partners, which ~~gives~~could ~~customers~~affect ~~the~~our ~~option~~ability to ~~upgrade~~compete toin ~~24x7x365~~specific ~~monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame~~situations.

~~Compliance~~As the market continues to evolve, we expect competition to increase as new vendors enter the space and existing providers expand their offerings. We believe our focus on platform consolidation, automation, and reducing data exposure positions us to compete effectively as customer requirements continue to change.

~~Discover and Identify Regulated Data. Our solutions automatically discover, identify and classify sensitive, critical and regulated data to help meet privacy and compliance requirements.~~Products

~~Monitor~~Our ~~and~~products ~~Detect~~are ~~Security~~delivered ~~Vulnerabilities.~~through ~~Our~~our ~~solutions~~flagship ~~analyze~~Varonis Data Security Platform, ~~monitor~~a unified platform designed to protect enterprise data across cloud, ~~detect~~SaaS and ~~report~~ on-premises ~~potential~~environments. ~~security~~With ~~vulnerabilities:~~the ~~helping~~introduction ~~companies~~of ~~achieve~~our ~~compliance~~SaaS byoffering, ~~creating~~we ~~full~~have ~~audit~~simplified ~~trails,~~how ~~achieving~~customers ause ~~least~~our ~~privilege~~capabilities ~~model~~by moving away from individually licensed modules and ~~locking~~towards ~~down~~a ~~sensitive~~platform-based ~~data~~model. toThis ~~only~~approach ~~those~~is ~~who~~intended ~~need~~to itreduce complexity, accelerate adoption ,and ~~facilitating~~enable ~~breach~~customers ~~notification~~to ~~and~~realize ~~security~~value ~~investigations.~~from Byautomation across multiple use cases.

ensuring the least privilege, monitoring all access and alerting on potential misuse, Varonis enables privacy by design on data stores containing sensitive and regulated information.

Fulfill Data Subject Access Requests ("DSARs") and Protect Consumer Data. Our solutions help fulfill DSARs from file systems on-premises and in the cloud. Customers can easily find relevant files, pinpoint who has access and enforce policies to move and quarantine regulated data.

Our Growth Strategy

Our objective is to be the primary vendor that enterprises turn to protect their data. The following are key elements of our growth strategy.

Extend Our Technological Capabilities Through Innovation and Strategic Transactions. We intend to increase, in absolute dollars, our current level of investment in product development to enhance existing products to address new use cases and continue to deliver new products, including through acquisitions. We believe that the flexibility, sophistication and broad applicability of our platform will allow us to use this framework as the core of numerous future products built on our same core technology. Our ability to leverage our research and development resources has enabled us to create a new product development engine that we believe can proactively identify and solve enterprise needs and help us further penetrate and grow our markets. We will continue to seek additional opportunities to extend our technological capabilities and grow our business, from continued organic investments in our research and development efforts to technological acquisitions.

Grow Our Customer Base. The unabated rise in enterprise data, ubiquitous reliance on digital collaboration and increased cybersecurity concerns continue to drive demand for data protection, compliance and threat detection and response solutions. We intend to capitalize on this demand by targeting new customers, underpenetrated markets and use cases for our solutions. Our solutions address the needs of customers of all sizes, ranging from small and medium-sized businesses to large multinational companies with hundreds of thousands of employees and petabytes of data. Although our solutions apply to organizations of all sizes, we have and will continue focusing on targeting larger organizations that can make larger purchases with us initially and over time.

Increase Sales to Existing Customers. We believe significant opportunities exist to further expand relationships with existing customers. Data growth and related security concerns continue across all data stores, and enterprises want to standardize solutions that help them manage, protect and extract more value from their data, wherever it is stored. We expect to continue to drive incremental sales from our existing customers through the increased use of our software within our installed base by expanding our footprint and usage. We believe our existing customer base is a strong source of future incremental revenues given our broad product functionality, the growing volume and complexity of enterprise data and the associated security concerns. As we continue to innovate by addressing more use cases, adding more data coverage, and providing automated data security outcomes to customers, we expect to see broader and stickier adoption of our platform. In addition, our transition to a SaaS delivery model provides us with a unique opportunity to convert existing customers to our SaaS offering. Our renewal rate for the year ended December 31, 2024 continued to be over 90%. Our key strategies to ensure a high renewal rate for our products include focusing on the quality and reliability of our customer service and support teams and providing software upgrades and enhancements when available.

Grow Sales from Our New Products and Functionality. We continue introducing additional products and enhancements to existing products to support new functionalities and believe these can also be a meaningful contributor to our growth. In October 2020, we announced the acquisition of Polyrize Security Ltd. ("Polyrize"), whose technology was used for the launch of DatAdvantage Cloud which provides support for cloud applications and infrastructure, including Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases. At the end of 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS, which was previously only sold as a self-hosted solution. Additionally, in 2024 we began offering MDDR to our SaaS customers, which further reduces both the likelihood of a breach and its potential impact by enabling automated 24x7x365 monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame.

Expand Our Sales Force. Continuing to expand our sales force will be essential to achieving our customer base expansion goals. Our approach to in-house development of sales representatives has been key to our successful growth in the past and will be central to our growth plan in the future. While our products serve customers of all sizes, across all industries and all geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, generate a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors. We also believe our existing customers represent significant future revenue opportunities for us. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and

professional sales force to efficiently identify leads, perform risk assessments and convert them to satisfied customers, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data.

Establish Our Data Security Platform as the Industry Standard. We have worked with several of the leading providers of NAS and hybrid cloud storage, including Dell/EMC, IBM and NetApp, as well as the major cloud service providers such as Microsoft, Amazon, Google and Salesforce to expand our market reach and deliver enhanced functionality to our customers. We have worked with these vendors to ensure compatibility with their product lines. Using application programming interfaces (APIs), and other integration work, our solutions also integrate with many providers of solutions in the ecosystem. We will continue to pursue such collaborations wherever they advance our strategic goals, thereby expanding our reach and establishing our platform as the de facto industry standard for enterprise data.

Continue International Expansion. We believe there is a significant opportunity for our platform to address the need for data protection and threat detection and response in international markets. Revenues from Europe, the Middle East and Africa (“EMEA") accounted for 21% and revenues from Rest of World (“ROW”) accounted for 6% of our revenues in 2024. We believe that international expansion will be a key component of our growth strategy, and we will continue to invest and market our products and services overseas.

Our Products

With the introduction of our flagship Varonis Data Security Platform as a SaaS, we are transitioning away from selling on-premises subscription licenses. Our SaaS offering is sold as a platform license, providing the functionality of multiple core modules in a single license. Our on-premises subscription licenses, on the other hand, offers an array of modules that customers can purchase individually or as a bundle.

Software-as-a-Service ("SaaS")

~~Our~~The ~~SaaS product portfolio currently includes two product lines: (1) our flagship~~ Varonis Data Security Platform, ~~which~~is ~~protects~~offered ~~Microsoft~~as ~~365,~~a ~~Windows~~SaaS ~~file~~solution ~~shares,~~and ~~Active~~is ~~Directory,~~sold ~~Edge~~as ~~devices~~a ~~(VPN,~~platform ~~DNS,~~license ~~proxy),~~that ~~UNIX/Linux~~includes ~~and~~a ~~hybrid~~core ~~NAS~~set ~~storage,~~of ~~and~~integrated ~~(2)~~capabilities. ~~DatAdvantage~~We ~~Cloud,~~believe ~~which~~this ~~protects~~delivery ~~IaaS~~and ~~environments~~licensing ~~and~~model ~~SaaS~~reflects ~~applications~~how ~~such~~customers asincreasingly ~~Salesforce,~~prefer ~~AWS,~~to ~~Azure,~~consume ~~Google~~security ~~Cloud,~~technology: ~~Google~~as ~~Workspace,~~a ~~Databricks,~~continuously ~~ServiceNow,~~updated ~~Snowflake,~~service ~~Slack,~~that ~~GitHub,~~reduces ~~Okta~~operational overhead and ~~Box,~~supports ~~Jira,~~automation ~~Zoom~~at ~~and databases~~scale.

~~•Varonis Data Security Platform.~~ The ~~success of our license bundles under the on-premises subscription ("OPS") model demonstrated that customers want to utilize and benefit from the majority of~~ Varonis’ core functionality from the start. We know that customers who utilize a higher number of licenses see more value upfront through automation and synergy between modules. Therefore, we drastically simplified our subscription licensing under SaaS, combining five of our most popular licenses into a single Varonis Data Security Platform ~~license. The Varonis Data Security Platform~~ SaaS license ~~will~~includes ~~include,~~capabilities bydesigned ~~default,~~to ~~the~~help ~~functionality~~customers ofunderstand ~~five~~their ~~core~~data ~~modules: DatAdvantage~~exposure, ~~DatAlert,~~reduce ~~Automation~~unnecessary ~~Engine~~access, ~~Data~~and ~~Classification~~detect ~~Engine~~ and ~~Data~~respond ~~Classification Policy Pack. We will no longer refer~~ to ~~these licenses by name; rather, they will be considered built-in functionality of the Varonis Data Security Platform SaaS license~~threats. InThese ~~addition to the functionality mentioned above, the Varonis Data Security Platform SaaS license includes new~~ capabilities ~~not available in our self-hosted product suite. Today, the Varonis Data Security Platform SaaS license includes~~include:

•Varonis Data Security Platform. We know that customers who utilize a higher number of licenses see more value upfront through automation and synergy between modules. Therefore, we drastically simplified our subscription licensing under SaaS, combining five of our most popular licenses into a single Varonis Data Security Platform license. The Varonis Data Security Platform SaaS license includes new capabilities not available in our self-hosted product suite. Today, the Varonis Data Security Platform SaaS license includes:

◦Data security posture management ("DSPM"). Provides customers with real-time visibility of their data security posture across their multi-cloud and on-premises data, helps prioritize remediation efforts, and tracks progress over time.

◦Data access intelligence. Combines data sensitivity, permissions, and activity to show customers who has access to critical data (i.e., their data blast radius), how they got access, and whether access is necessary.

◦Data discovery & classification. Automatically and continuously scans the contents of files, folders, and other objects to determine sensitivity with a high degree of accuracy and precision.

◦Discovery policy library. A frequently updated library for identifying and classifying personal information specific to GDPR, CCPA, and US federal controlled unclassified information (CUI).

◦Least privilege automation. Automatically and continuously remediates excessive data access granted via shared links, direct permissions, and group memberships without manual effort and without impacting business continuity.

◦Data activity monitoring. Gives customers a real-time view into who is accessing data directly or through AI (such as copilots) via a normalized and enriched log of data-centric events such as create, open, read, move, modify, and delete. Varonis also tracks, among other things, permission changes, authentication events, password updates and shared link activity.

◦Data detection and response. Provides high-fidelity, data-centric alerts and automated response actions. Includes a web-based alerts dashboard and investigative interface, and seamlessly integrates with security information and event management systems (SIEM).

◦User & entity behavior analytics. Profiles users, agents and devices and their associated behaviors with respect to systems and data, detects and alerts on meaningful deviations that indicate compromise. New UEBA threat models are automatically delivered to customers to guard against evolving tactics used by cybercriminals, insiders and advanced persistent threats (APTs).

~~Varonis~~Customers ~~Data~~select ~~Security Platform SaaS customers can decide~~ which ~~data stores, applications, and infrastructure~~ environments ~~they want~~ to protect by purchasing “Protection Packages.” ~~Our~~These ~~SaaS~~packages ~~platform supports every resource covered by our self-hosted version, and we believe our SaaS architecture will~~ allow uscustomers to ~~move~~extend ~~quickly to add support for new resources. Additionally, SaaS customers can purchase MDDR which further reduces both~~ the ~~likelihood~~platform ofacross: ~~a breach and its potential impact by enabling automated 24x7x365 monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame.~~

~~The~~◦Microsoft ~~Protection~~365. ~~Packages~~Includes ~~currently~~support ~~available~~for SharePoint Online, OneDrive for ~~the~~Business, ~~Varonis~~Microsoft ~~Data~~Teams, ~~Security~~and ~~Platform~~Entra ~~SaaS~~ID ~~are:~~(formerly known as Azure AD). Customers can purchase add-on support for Exchange Online, Microsoft 365 Copilot and ChatGPT Enterprise.

◦Microsoft 365. Includes support for SharePoint Online, OneDrive for Business, Microsoft Teams, and Entra ID (formerly known as Azure AD). Customers can purchase add-on support for Exchange Online and Microsoft 365 Copilot.

◦Windows & NAS. Includes support for Windows/CIFS-based file shares and NAS storage such as Nutanix, Nasuni, Panzura, Pure Storage, NetApp and Dell EMC. Customers can purchase add-on support for on-premises Active Directory, UNIX/Linux and Edge devices (VPN, DNS, proxy).

◦Hybrid. Combined support for the protected resources in the Microsoft 365 and Windows & NAS packages.

•Varonis DatAdvantage Cloud. DatAdvantage Cloud is a SaaS platform that helps organizations protect data across SaaS applications and IaaS environments. DatAdvantage Cloud offers functionality similar to our flagship Varonis Data Security Platform including, but not limited to, data security posture management, SaaS security posture management, data classification, data access intelligence, data activity monitoring, data detection and response, and least privilege automation. The protected resources currently available for DatAdvantage Cloud are Salesforce, AWS, Azure, Google Cloud, Google Worskpace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases.5

~~On-Premises~~◦Cloud ~~Subscription~~Environments. Protects data across SaaS applications and IaaS environments. The protected resources currently include Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Confluence, Slack, GitHub, Okta, Box, Jira, Zoom and databases.

~~Our~~We ~~self-hosted~~believe ~~product~~this ~~licenses~~packaging ~~utilize~~approach ~~our~~enables ~~core~~customers ~~technology~~ to ~~deliver~~scale ~~features~~coverage ~~and~~over ~~functionality~~time ~~that~~while ~~allow~~maintaining enterprises to fully understand, secure and benefit from the value of their data. This architecture gives our clients the ability to select the features they require for their business needs and the flexibility to expand their usage simply by adding a ~~license,~~consistent ~~and~~operating ~~the fully integrated nature of our products allows individual products to enhance the functionality of the others~~model.

~~•DatAdvantage.~~The ~~DatAdvantage,~~SaaS ~~our~~platform ~~flagship~~also ~~product,~~serves ~~captures,~~as ~~aggregates,~~the ~~normalizes~~foundation ~~and~~for ~~analyzes~~advanced ~~every~~capabilities ~~data~~that ~~access~~require ~~event~~persistent ~~for~~visibility ~~every user on Windows~~ and ~~UNIX/Linux servers~~automation, ~~storage~~including ~~devices,~~our ~~email~~MDDR ~~systems,~~offering. ~~Intranet~~MDDR ~~servers,~~provides ~~cloud~~customers ~~applications~~with ~~and~~continuous ~~data~~monitoring ~~stores,~~and ~~without~~response ~~requiring~~backed ~~native~~by ~~operating~~defined ~~system~~service-level ~~auditing~~commitments ~~functionalities~~and oris ~~impacting~~available ~~performance~~exclusively orthrough ~~storage~~our onSaaS ~~file systems~~platform.

7Database and Email Security Capabilities

~~•DatAlert.~~In ~~DatAlert~~addition ~~profiles users and devices and their associated behaviors with respect~~ to ~~systems~~our ~~and~~core ~~data~~platform functionality, ~~detects~~we ~~and~~offer ~~alerts~~specialized oncapabilities ~~meaningful deviations~~ that ~~indicate~~extend ~~compromise~~protection ~~and~~to ~~seamlessly~~additional ~~integrates~~high-risk ~~with security information and event management systems (SIEM)~~areas.

•~~Data~~Varonis ~~Classification~~Database ~~Engine.~~Activity ~~Data~~Monitoring ~~Classification~~(“DAM”). ~~Engine~~Provides ~~identifies~~cloud-native monitoring and ~~tags~~security ~~data~~for ~~based~~ on-premises ~~criteria~~and ~~set~~cloud indatabases ~~multiple~~and ~~metadata~~is ~~dimensions~~integrated ~~and~~with ~~provides~~the ~~business~~broader ~~and~~platform ITto ~~personnel~~deliver ~~with~~consistent ~~actionable~~visibility, ~~intelligence~~classification, ~~about~~and ~~this data~~response.

•~~DataPrivilege~~Varonis Interceptor. ~~DataPrivilege~~Provides ~~provides~~best-of-breed aphishing ~~self~~prevention and malicious link interception with multi-~~service~~modal ~~web~~AI ~~portal~~and ~~that~~URL ~~allows~~sandboxing ~~users~~technologies, toextending ~~request~~platform ~~access~~protection to ~~data~~email ~~necessary~~and ~~for~~collaboration ~~their~~channels. ~~business~~When ~~functions~~combined with our MDDR solution, Varonis Interceptor detects and ~~allows~~protects ~~owners~~across todata ~~review~~stores, ~~accessibility~~applications, and communication channels.

~~•Data~~On-Premises ~~Transport~~Subscription ~~Engine.~~Products Data Transport Engine provides an execution engine that unifies the manipulation of data and metadata, translating business decisions and instructions into commands, such as data migration or archiving.

~~•DatAnswers.~~Prior ~~DatAnswers~~to ~~provides~~the aintroduction ~~secure~~of our SaaS offering, ~~relevant~~we ~~and~~sold ~~timely~~our ~~search~~products ~~functionality~~primarily ~~for~~through ~~enterprise~~self-hosted ~~data~~subscription ~~and~~licenses ~~helps~~that ~~companies~~allowed ~~comply~~customers ~~with~~to ~~data~~deploy ~~privacy~~individual ~~regulations,~~modules ~~eDiscovery~~on-premises. ~~requests~~These ~~and~~products used our core technology to ~~facilitate~~provide ~~data~~visibility, ~~subject~~classification, access ~~requests~~governance and monitoring across enterprise data environments.

~~Our~~As ~~Customers~~part of our strategic transition to SaaS, we have announced the end-of-life of our on-premises subscriptions as of December 31, 2026. We expect customers to adopt our SaaS platform as the primary way to engage our capabilities going forward.

We currently have customers in over 95 countries. Our customers span numerous industries and vary greatly in size, ranging from small and medium businesses to large multinational enterprises and government agencies. Our customers include leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors, with hundreds of thousands of employees and petabytes of data.Customers

We serve a global customer base across more than 95 countries, supporting organizations that operate in different environments and face significant security, privacy and compliance requirements. Our customers span a wide range of industries, including financial services, public, healthcare, industrial, insurance, energy and utilities, technology, construction and engineering, education, and consumer and retail sectors.

Our platform is used by organizations ranging from small and mid-sized businesses to large multinational enterprises with hundreds of thousands of employees and petabytes of data. While our solutions are applicable across company sizes, a significant portion of our customer base consists of larger enterprises that benefit most from automation at scale and from a unified approach to data security.

We believe our customer relationships are durable and expand over time. As customer data volumes grow, environments become more distributed and AI-driven workflows are adopted, customers typically extend platform coverage to additional data stores, applications, and use cases. This expansion is supported by our platform-based model, continuous SaaS delivery and focus on reducing data exposure and operational burden.

Our customers include organizations that manage highly sensitive information, such as personal and financial data, intellectual property and regulated data. We believe our ability to deliver automated risk reduction, rapid detection and response, and measurable security outcomes, positions as a long-term partner rather than a point solution provider.

Services

Maintenance and Support of Subscription and Perpetual Licenses

Maintenance and support associated with a term license subscription is included in the Term license subscriptions revenue line of the statement of operations. Maintenance and support associated with past perpetual licenses is included in the Maintenance and services line of the statement of operations. These maintenance agreements provide customers the right to receive support and unspecified upgrades and enhancements when and if they become available during the maintenance period and access to our technical support services. Our renewal rate for ~~2024~~2025 continued to be over 90%. Due to the transition to a SaaS delivery model, we expect maintenance and support revenues related to term license subscriptions to ~~continue~~decline, as we move closer to ~~decline~~their end-of-life. Additionally, we do not expect perpetual license revenues in the future and, accordingly, we also expect the associated maintenance and support to ~~continue to~~ decline.

We maintain a customer support organization that provides all levels of support to our customers. Our customers ~~that purchase maintenance and support services~~ receive guaranteed response times, direct telephonic support and access to online support portals. Our customer support organization has global capabilities with expertise in both our software and complex IT environments and associated third-party infrastructure.

Professional Services

While users can easily deploy our software on their own, certain enterprises use our professional service team to provide fee-based services, which include training our customers in the use of our products, providing advice on network design, product configuration and implementation, automating and customizing reports and tuning policies and configuration of our products for the particular characteristics of the customer’s environment. Although professional services have always been a small percentage of our total revenues, we have recently seen, and expect to continue to see, that percentage decline as many of our newer licenses can provide remediation in more automated ways.

Sales and Marketing

Sales

We sell ~~substantially all of~~ our products and services tothrough a global network of resellers and distributors, ~~that~~which we refer to as our channel partners. ~~Our~~These channel partners, ~~in turn,~~ sell ~~the~~our products ~~they purchase from us~~ to end customers. Inand ~~addition,~~play ~~we maintain~~ a ~~highly~~key ~~trained~~role ~~professional~~in ~~sales~~identifying ~~force~~opportunities, ~~that~~maintaining iscustomer ~~responsible~~relationships ~~for~~and ~~overall~~supporting ~~market~~deployment. ~~development,~~Sales ~~including~~to ~~the~~channel ~~management~~partners ofare ~~the~~subject ~~relationships~~to ~~with~~ our ~~channel~~standard, ~~partners~~non-exclusive ~~and supporting~~ channel ~~partners~~partner inagreements ~~winning~~that ~~customers~~are ~~through~~generally ~~operating~~renewed ~~demonstrations~~annually and ~~risk~~can ~~assessments.~~be ~~Our~~terminated ~~channel~~by ~~partners~~either ~~identify~~party ~~potential sales targets, maintain relationships~~ with notice.

8Our channel model is complemented by a highly trained, professional sales organization that is responsible for market development, managing partner relationships and supporting customer engagements. Our sales teams work closely with channel partners to conduct platform demonstrations and risk assessments that help customers understand their data exposure and the value of reducing risk through automation. We believe this approach allows us to clearly articulate and show the value of our platform.

customers and introduce new products to existing customers. Sales to our channel partners are generally subject to our standard, non-exclusive channel partner agreement. These agreements are generally for a term of one year with an automatic renewal of successive one-year periods and can be terminated by us or the channel partner for any reason upon 30 days’ notice. A termination of the agreement has no effect on orders already placed. Payment to us from the channel partner is typically due within 30 to 60 calendar days of the invoice date.

Marketing

Our marketing strategy ~~focuses~~is focused on building ~~our~~ brand and product awareness, ~~increasing~~of ~~customer adoption and demand, communicating advantages and business benefits as well as generating leads for our channel partners and sales force. We market our software as~~ the Varonis Data Security Platform, aeducating ~~solution~~the ~~for~~market ~~securing~~on ~~and managing enterprise~~ data. Werisk ~~execute our marketing strategy by leveraging a combination of internal marketing professionals, external marketing partners~~ and ~~a network of regional and global channel partners. Our marketing organization is responsible for branding~~automation, ~~content creation, demand generation, field marketing~~ and ~~product~~supporting ~~marketing,~~customer ~~and~~adoption ~~works with our business operations team to support channel marketing~~ and ~~sales support programs~~expansion. We ~~provide~~seek ~~one-on-one~~to ~~and~~communicate ~~community education and awareness and promote~~ the ~~expanded~~business use of our software. We host in-person or virtual Varonis Connect! customer events across sales regions, as well as free, online technical webinars across multiple regions. We focus our efforts on highly relevant content, events, campaigns and ~~activities~~security ~~that~~outcomes ~~can be leveraged by~~ our ~~channel~~platform ~~partners~~delivers ~~worldwide~~rather tothan ~~extend~~emphasizing ~~our~~individual ~~marketing~~features ~~reach,~~or ~~such~~point ~~as information regarding product awards and technical certifications, security training, regional seminars and conferences, webinars, podcasts and various other demand-generation activities~~solutions. Our marketing efforts also include public relations across multiple regions, industry analyst relations, customer marketing, account-based marketing, targeted advertising, extensive content development available through our website and content syndication, and our active blog.

We execute our marketing programs through a combination of internal teams, external partners and channel collaboration. Our activities include brand and content marketing, demand generation, field marketing and partner marketing, customer education and public relations. We also engage with industry analysts, host customer and community events and provide educational resources such as webinars, training programs, and technical content.

We believe that sustained investment in thought leadership and education is important as data security requirements evolve, particularly in areas such as cloud adoption and AI-driven systems. Our marketing efforts are designed to support long-term platform adoption by helping customers and partners understand how to reduce data exposure and operate as environments grow more complex.

Research and Development

Our research and development efforts are focused ~~primarily~~ on ~~improving~~advancing ~~and~~the ~~enhancing~~Varonis ~~our~~Data ~~existing~~Security ~~products,~~Platform asby ~~well as~~ expanding ~~our~~coverage, ~~platform~~increasing toautomation ~~cover new sources of data~~ and ~~developing~~improving ~~new products. Use of~~ our ~~products~~ability ~~has~~to ~~expanded~~reduce ~~beyond just~~ data ~~security~~exposure ~~into threat detection~~ and ~~response,~~respond ~~data~~to ~~privacy~~threats ~~and~~at ~~data lifecycle management, and we anticipate that customer demand and innovation will drive functionality into additional areas~~scale. We ~~regularly~~invest ~~release~~in ~~updates~~innovation tothat ~~our~~strengthens ~~products which incorporate new features and enhancements to existing ones. We conduct~~ the ~~majority~~platform’s ofcore ~~our~~capabilities ~~research~~ and ~~development~~allows ~~activities~~it ~~in Israel, and we believe this provides us with access~~ to ~~world-class~~adapt ~~engineering~~as ~~talent.~~enterprise Indata ~~addition~~environments, wethreat ~~continue~~models ~~to seek opportunities to extend our technological capabilities~~ and ~~grow~~regulatory ~~our~~requirements ~~business from strategic technological acquisitions~~evolve.

We conduct the majority of our research and development activities in Israel, which we believe provides access to a highly skilled engineering workforce with deep expertise in security, data systems and large-scale software development. In

addition to organic development, we selectively pursue strategic acquisitions that bring specialized technologies and talent to the platform, accelerating innovation while maintaining a unified architecture.

We believe our sustained investment in research and development supports the long-term competitiveness of our platform and positions us to address emerging risks, including those introduced by new data types, cloud architecture and AI-driven systems.

Intellectual Property

We attempt to protect our technology and the related intellectual property under patent, trademark, copyright and trade secret laws, confidentiality procedures and contractual provisions. No single intellectual property right is solely responsible for protecting our products. The nature and extent of legal protection of our intellectual property rights depends on, among other things, its type and the jurisdiction in which it arises. As of December 31, ~~2024~~2025, we had 89116 issued patents and 3163 pending patent applications in the United States. Our issued U.S. patents expire between ~~2025~~2026 and ~~2042~~2043. We also had 7695 patents issued and 3479 applications pending for examination in non-U.S. jurisdictions, and 1831 pending Patent Cooperation Treaty (“PCT”) patent applications, all of which are counterparts of our U.S. patent applications. The claims for which we have sought patent protection relate primarily to inventions we have developed for incorporation into our products.

In addition to patented technology, we rely on our unpatented proprietary technology and trade secrets. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors and customers and generally limit internal and external access to, and distribution of, our proprietary information and proprietary technology through certain procedural safeguards. We also rely on invention assignment agreements with our employees, consultants and others, to assign to the Company all inventions developed by such individuals in the course of their engagement with the Company.

Moreover, we have registered the “Varonis” name and logo and “DatAdvantage,” “DataPrivilege,” “DatAlert,” and other names in the United States and, as related to some of these names, certain other countries.

In addition to Company-owned intellectual property, we license software from third parties for integration into our solution, including open-source software and other software available on commercially reasonable terms. It may be necessary in the future to seek or renew licenses relating to various aspects of our products, processes and services. While we have generally been able to obtain such licenses on commercially reasonable terms in the past, such third parties may not continue to maintain such software or continue to make it available to us.

Seasonality

See Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Seasonality and Quarterly Trends.”

Competition

While there are some companies which offer features similar to those embedded in our platform, we believe that we do not currently compete with a company that offers comparable depth of functionality, scalability, or support for the number of data stores, applications and infrastructure environments that we cover. Nevertheless, we do compete against a select group of software vendors when the scope of a purchase is limited to a specific use case, such as DSPM, data discovery and classification, data privacy, data migration, data subject access requests and/or Active Directory security.

As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs with new regulations, and as these functionalities continue to be recognized as critical to protect enterprise data, we may face increased perceived and real competition from other data security and privacy technologies. In the future, as customer requirements evolve and new technologies are introduced, we may experience increased competition if established or emerging companies develop solutions that address the enterprise data market. Furthermore, because we operate in an evolving market, we anticipate that competition will increase based on customer demand for these types of products.

A number of factors influence our ability to compete in the markets in which we operate, including, without limitation: the continued reliability and effectiveness of our products’ functionalities; the breadth and completeness of our solutions’ features; the scalability of our solutions; and the ease of deployment and use of our products. We believe that we generally compete favorably in each of these categories. We also believe that we distinguish ourselves from others by delivering an integrated solution and sophisticated automation to address our customers’ needs regarding data security, threat detection and response, data privacy and retention. However, we may not be able to remain unique in this capacity or continue to be able to compete favorably with other providers in the future.

If a more established company were to target our market, we may face significant competition. They may have competitive advantages, such as greater name recognition, larger sales, marketing, research and acquisition resources, access to larger customer bases and channel partners, a longer operating history and lower cloud labor and development costs, all of which may enable them to respond more quickly to new or emerging technologies and changes in customer requirements or to devote greater resources to the development, promotion and sale of their products than we do. Increased competition could result in us failing to attract customers or maintain renewals and licenses at the same rate. It could also lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, reduced gross margins, longer sales cycles and loss of market share.

In addition, our current or prospective channel partners may establish cooperative relationships with any future competitors. These relationships may allow future competitors to rapidly gain significant market share. Such developments could also limit our ability to generate revenues from existing and new customers. If we are unable to compete successfully against current and future competitors, our business, results of operations and financial condition may be harmed.

Employees and Human Capital Resources

As of December 31, ~~2024~~2025, we had 2,~~406~~658 employees and independent contractors who developed, marketed, sold and supported our technology solutions, including 1,~~081~~139 in the United States, ~~844~~916 in Israel and ~~481~~603 in other countries.

We understand that our innovation leadership is ultimately rooted in our people. Competition for qualified personnel in the technology space is intense, and our success depends in large part on our ability to recruit, develop and retain a productive and engaged workforce. Accordingly, investing in our employees and their well-being, offering competitive compensation and benefits, promoting diversity and inclusion, adopting effective human capital management practices and community outreach constitute core elements of our corporate strategy.

•Offer Competitive Compensation and Benefits. We strive to ensure that our employees receive competitive and fair compensation and innovative benefit offerings, tying incentive compensation to both business and individual performance, offering competitive maternal and paternal leave policies, providing meaningful retirement and health benefits and maintaining an employee stock purchase plan.

10•Support Employee Well-being and Engagement. We support the overall well-being of our employees from a physical, emotional, financial and social perspective. Our global well-being programs include a long-standing practice of remote working arrangements, flexible paid time off, life planning benefits, wellness platforms and employee assistance. In addition, we ensure ongoing check-ins with employees by HR and managers to provide additional channels of support. We also regularly seek input from employees, including through broad employee satisfaction and pulse surveys on

•Support Employee Well-being and Engagement. We support the overall well-being of our employees from a physical, emotional, financial and social perspective. Our global well-being programs include a long-standing practice of remote working arrangements, flexible paid time off, life planning benefits, wellness platforms and employee assistance. In addition, we ensure ongoing check-ins with employees by HR and managers to provide additional channels of support. We also regularly seek input from employees, including through broad employee satisfaction and pulse surveys on specific issues, intended to assess our degree of success in promoting an environment where employees are engaged, satisfied, productive and possess a strong understanding of our business goals.8

specific issues, intended to assess our degree of success in promoting an environment where employees are engaged, satisfied, productive and possess a strong understanding of our business goals.

•Promote Sense of Belonging. We conduct code of conduct trainings with employees and managers to share our views on the importance of respecting all individuals and creating a culture where everyone feels they belong. We have Employee Resource Groups, led by our employees, designed to foster connection, understanding and support. Our customers are located in over 95 countries and our global workforce operates across cultures, functions, language barriers and time zones to provide them dedicated and ongoing support.

•Provide Programs for Employee Recognition. We offer rewards and recognition programs to our employees, including awards to recognize employees who best exemplify our values and spot awards to recognize employee contributions. We believe that these recognition programs help drive strong employee performance. We conduct semi-annual employee performance reviews, where each employee is evaluated by their personal manager and also conducts a self-assessment, a process which empowers our employees. Employee performance is assessed based on a variety of key performance metrics, including the achievement of objectives specific to the employee’s department or role. Employees have access to an internal platform to recognize their peers based on their professional and socially responsible contributions to the Company.

•Create Opportunities for Growth and Development. We focus on creating opportunities for employee growth, development, training and education, including opportunities to cultivate talent and identify candidates for new roles from within the company, as well as management and leadership development programs. Employee training and education includes online certification, in person certification and new hire training bootcamps. We also conduct manager training programs on an annual basis, which include in-depth managerial and coaching skills, as well as tailored feedback. We have established an internal mentoring program in which seasoned employees' mentor new managers based on defined goals.

•Promote Community Outreach and Support. We believe it is important to give back and promote community outreach and support through corporate giving and employee volunteerism in the communities in which we live and work. We partner with several organizations providing life skills trainings, coding and basic IT skills, financial literacy and more. All programs are led by our employees on a volunteering basis. We also provide corporate matching of employee charitable donations and flexible volunteering during work time, letting our employees know that we support the charitable efforts that matter to them.

Available Information

Our website is located at www.varonis.com, and our investor relations website is located at https://ir.varonis.com. The information posted on our website is not incorporated into this Annual Report on Form 10-K. Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Exchange Act are available free of charge on our investor relations website as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (the “SEC"). You may also access all of our public filings through the SEC’s website at www.sec.gov.

Investors and other interested parties should note that we use our media and investor relations website and our social media channels to publish important information about us, including information that may be deemed material to investors. We encourage investors and other interested parties to review the information we may publish through our media and investor relations website and the social media channels listed on our media and investor relations website, in addition to our SEC filings, press releases, conference calls and webcasts.


Item 1A.			Risk Factors

Investing in our securities involves risk. You should carefully consider the following risks and all other information contained herein, including our consolidated financial statements and the related notes thereto. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed.

Risks Related to the Industry in which we Operate

The market for software that analyzes, secures, governs, manages and migrates enterprise data may not continue to grow or grow at the same pace.

We believe our future success depends in large part on the continued growth of the market for software that enables enterprises to analyze, secure, govern, manage and migrate their data. In order for us to market and sell our products, we must successfully demonstrate to enterprise IT, security and business personnel the risk of their valuable data getting compromised or stolen and the effectiveness of our products to mitigate these risks. Despite a number of high-profile cyberattacks around the world, we must still persuade customers to devote a portion of their budgets to a unified platform that we offer to analyze, secure, govern, manage and extract value from this resource. Enterprises may not recognize the need for our products or, if they do, may not decide that they need a solution that offers the range of functionalities that we offer. The market for our solution may not continue to grow at its current rate or at all and the failure of the market to continue to develop would materially adversely impact our results of operations.

Prolonged economic uncertainties or downturns could materially adversely affect our business.

Our business depends on our current and prospective customers’ ability and willingness to invest in IT services, including cybersecurity projects, which in turn is dependent upon their overall economic health. Negative conditions in the general economy both in the United States and abroad, including inflationary pressure, currency fluctuations and a higher interest rate environment, changes in gross domestic product growth, instability in connection with political elections, potential future government shutdowns, the federal government’s failure to raise the debt ceiling, financial and credit market fluctuations, the imposition of trade barriers and restrictions such as tariffs, including tariffs implemented around the world by the United States or other countries, political deadlock, restrictions on travel, natural catastrophes, warfare and terrorist attacks, could cause a decrease in business investments, including corporate spending on enterprise software in general and negatively affect the rate of growth of our business. For example, our operations, and the operations of our customers and partners, were affected by geopolitical turmoil and sanctions caused by the war between Russia and Ukraine, and the COVID-19 pandemic and efforts to control its spread, including by mandatory business closures and capacity limitations imposed by the jurisdictions in which we operate. Similar events and restrictions in the future could negatively affect our business.

Uncertainty in the global economy makes it extremely difficult for our customers and us to forecast and plan future business activities accurately. This could cause our customers to reevaluate decisions to purchase our product or to delay their purchasing decisions, which could lengthen our sales cycles and negatively impact our results. In recent years, the European economy experienced economic turmoil that caused the devaluation of local European currencies (specifically, the Euro and the Pound Sterling), inflationary pressures and general economic uncertainty. As a result, there has been, and may in the future be, budgetary tightening and longer sales cycles in the region which may negatively impact our results of operations. In addition, the imposition of tariffs, such as those implemented by the United States or other countries in 2025, may materially impact business performance for companies operating around the world and may cause budgetary tightening and longer sales cycles for companies in those impacted countries. The United States could also experience a sustained period of elevated inflation, which may put pressure on discretionary spending by our customers, and a lengthening of our sales cycle in the region, which could negatively impact our results.

A downturn in any of our leading industries, or a reduction in any revenue-generating vertical, may cause enterprises to react to worsening conditions by reducing their spending on IT. Customers may delay or cancel IT projects, choose to focus on in-house development efforts or seek to lower their costs by renegotiating maintenance and support agreements. To the extent purchases of our software are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general IT spending. In addition, consolidation in certain industries may result in reduced spending on our software. If the economic conditions of the general economy or industries in which we operate worsen from present levels, our business, results of operations and financial condition could be adversely affected.

Overall economic uncertainty may in the future give rise to a number of risks, including, but not limited to, the following:

• reduced economic activity could lead to a prolonged recession, which could negatively impact spending by our customers or the ability of customers to pay for our services;

• not meeting expectations with respect to certain key performance metrics, such as renewal rates and annual recurring revenues;

• our ability to enter into new markets and to acquire new customers;

• an increase in bad debt reserves as customers face economic hardship and collectability becomes more uncertain, including the risk of bankruptcies;

• variability with forward-looking guidance and financial results, including management’s accounting estimates and assumptions; and

• our ability to raise capital.

The challenges posed by and the full impact of negative conditions in the general economy on our business and our future performance are difficult to predict and there is a risk that any guidance we provide to the market may turn out to be incorrect.

We may face increased competition in our market.

~~While~~Data ~~there~~security ~~are~~is ~~some~~a ~~companies~~rapidly ~~which~~growing ~~offer~~and ~~certain~~evolving ~~features similar to those embedded in our solutions~~market, asdriven ~~well~~by asincreasing ~~others~~regulatory ~~with whom we compete in certain tactical use cases~~demands, ~~we believe that we do not currently compete with a company that offers~~ the ~~same~~proliferation ~~breadth~~ of ~~functionalities~~data onacross ~~the~~hybrid ~~number of platforms and applications that we cover. Nevertheless~~environments, wethe dorising ~~compete~~sophistication ~~against a select group~~ of ~~software~~cyber ~~vendors~~threats ~~that~~and ~~provide~~increasing ~~standalone~~AI ~~solutions~~usage, ~~similar~~which toincreases ~~those found in our comprehensive software suite, in~~ the ~~specific~~need ~~markets~~for ~~in which we operate. We also face direct competition with respect to certain use cases, specifically DSPM,~~ data ~~discovery and classification, privacy, data migration, data subject access requests and Active Directory~~ security. As wea ~~continue~~result, tothe ~~augment~~market ~~our~~is ~~functionality~~attracting ~~with~~investment AIfrom ~~security,~~both ~~insider~~established ~~threat~~players ~~detection~~ and ~~user~~emerging ~~behavior~~innovators, ~~analytics~~which ~~and~~is asdriving weincreased ~~expand~~awareness ~~our~~for ~~classification~~the ~~capabilities~~need to ~~better~~secure ~~serve compliance needs~~data, ~~such~~increasing asthe ~~General~~size ~~Data~~of ~~Protection Regulation ("GDPR"),~~ the ~~California Consumer Privacy Act ("CCPA") and other~~ data ~~privacy~~security ~~laws,~~market ~~we may face increased perceived~~ and ~~real~~intensifying ~~competition~~the ~~from~~competitive ~~other security and classification technologies~~landscape. AsOver time, we ~~expand~~have ~~our~~strategically ~~coverage~~made ~~and~~investments ~~penetration~~ in ~~the~~our ~~cloud,~~platform weto ~~may~~better ~~face~~serve ~~increased~~our ~~perceived~~customers and ~~real~~also ~~competition~~address ~~from other cloud-focused technologies. In the future, as customer requirements evolve and~~ new ~~technologies~~use ~~are introduced~~cases, wewhich ~~may~~has ~~experience~~grown ~~increased~~our ~~competition if established or emerging companies develop solutions that address the enterprise data~~ market. ~~Furthermore,~~opportunity ~~because~~and wealso ~~operate~~brought inus aninto ~~evolving~~more ~~area,~~competitive ~~we anticipate that competition will increase based on customer demand for these types of products~~discussions.

While there are some companies which offer certain features similar to those embedded in our solutions, and others with whom we compete in certain tactical use cases, we believe that no single competitor delivers the same automated outcomes on the number of platforms and applications that we support. However, we do face competition from a select group of software vendors that provide standalone solutions similar to those features embedded in our comprehensive platform, particularly in the markets we serve. We also face direct competition in specific use cases, specifically DSPM, data discovery and classification, privacy, data migration, data subject access requests and Active Directory security. As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs, such as General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and other data privacy laws, we may face increased perceived and real competition from other security and classification technologies. Our growing presence in the cloud data security market and our broader product coverage are also placing us in more direct competition with companies focused on discovery and classification. As customer requirements evolve and new technologies emerge, we face heightened competition from companies—both established and emerging—that develop solutions targeting the enterprise data market.

In particular, if a more established company were to target our market, we may face significant competition. They may have competitive advantages, such as greater name recognition, larger sales, marketing, research and acquisition resources, access to larger customer bases and channel partners, a longer operating history and lower labor and development costs, which may enable them to respond more quickly to new or emerging technologies and changes in customer requirements or devote greater resources to the development, promotion and sale of their products than we do. Increased competition could result in us failing to attract customers or maintain licenses at the same rate. It could also lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, reduced gross margins, longer sales cycles, lower renewal rates and loss of market share.

In addition, our current or prospective channel partners may establish cooperative relationships with future competitors. These relationships may allow future competitors to rapidly gain significant market share. These developments could also limit our ability to obtain revenues from existing and new customers.

Our ability to compete successfully in our market will also depend on a number of factors, including ease and speed of product deployment and use, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to successfully address current or future competition in any one of these or other areas may reduce the demand for our products and adversely affect our business, results of operations and financial condition.

Lastly, at times, we engage in discussions and collaborations with other technology companies, including companies that offer security‑related products, regarding potential partnerships, integrations, or commercial relationships. While these discussions are intended to expand our ecosystem and market reach, they may involve the sharing of information about our products, strategy, and potential future development plans. Even where appropriate confidentiality measures are in place, these counterparties may use knowledge gained through such interactions to inform their own product development, roadmap decisions, or competitive strategies, including in ways that increase competition with us. As a result, our efforts to pursue partnerships could accelerate the development of competing offerings or otherwise adversely affect our competitive position.

We are subject to a number of legal requirements, contractual obligations and industry standards regarding security, data protection and privacy, and any failure to comply with these requirements, obligations or standards could have an adverse effect on our reputation, business, financial condition and operating results.

Privacy and data ~~information~~protection ~~security~~laws ~~have become a significant issue~~ in the United States and ininternationally ~~many~~are ~~other countries where we have employees and operations and where we offer licenses to our products. The regulatory framework for privacy and personal information security issues worldwide is~~ rapidly evolving and isremain ~~likely~~subject to ~~remain uncertain for the foreseeable future~~uncertainty. ~~The~~ U.S. federal, ~~and various~~ state, and foreign ~~government~~authorities ~~bodies and agencies~~ have ~~adopted~~enacted, ~~or are considering adopting laws~~ and ~~regulations~~continue ~~limiting~~to consider, or laws ~~and~~governing ~~regulations regarding,~~ the collection, ~~distribution,~~ use, ~~disclosure, storage and security of personal information. For example, the CCPA, which went into effect on January 1, 2020, applies to personal data of~~

1311

~~consumers~~disclosure, ~~business representatives~~storage, and ~~employees~~security ~~who~~of ~~are~~personal ~~California~~information. ~~residents,~~In ~~and~~the ~~requires,~~United ~~among other things~~States, ~~covered~~the ~~companies to provide specific disclosures to~~ California ~~consumers and afford such consumers new abilities to exercise certain privacy rights, including opting out of certain sales of personal information.~~ Consumer ~~rights~~Privacy ~~and~~Act ~~obligations under the~~ (CCPA) ~~were~~and ~~expanded by~~ the California Privacy Rights Act ("CPRA") onimpose ~~November~~significant 3,obligations ~~2020.~~on ~~The~~businesses ~~CPRA~~and ~~took~~grant ~~effect~~consumers onenhanced ~~January 1~~rights, ~~2023,~~such ~~along~~as ~~with~~ the ~~Virginia~~ability ~~Consumer~~to ~~Data~~opt ~~Protection~~out ~~Act;~~of ~~the~~certain ~~Colorado~~sales ~~Privacy~~of ~~Act~~personal ~~and~~information. ~~Connecticut~~In ~~Act~~2025, ~~Concerning~~additional ~~Personal~~comprehensive ~~Data~~privacy ~~Privacy~~laws ~~and Online Monitoring~~ took effect onin ~~July~~Delaware, 1Iowa, ~~2023~~Nebraska, ~~and~~New ~~the~~Hampshire, ~~Utah~~New ~~Consumer~~Jersey, ~~Privacy~~Tennessee, ~~Act took effect on December 31~~Minnesota, ~~2023.~~and ~~In the past few years~~Maryland, ~~numerous~~and ~~other~~further ~~U.S.~~state ~~states have enacted comprehensive~~ privacy laws, ~~and~~are wescheduled ~~expect~~to ~~more~~take ~~states~~effect toin ~~pass~~2026, ~~similar~~including ~~laws~~ in ~~the~~Indiana, ~~future.~~Kentucky, ~~These~~and ~~laws~~Rhode ~~impose~~Island. ~~similar~~Collectively, ~~obligations~~these onframeworks ~~businesses~~generally ~~with~~require ~~regard~~detailed todisclosures, ~~the~~honoring ~~use~~consumer rights, ~~disclosure~~ and ~~security~~implementing ofrobust ~~personal~~data ~~information~~protection safeguards, and ~~grant~~they ~~additional~~expand ~~rights~~the inpatchwork ~~that~~of ~~personal~~compliance ~~information~~obligations toacross ~~consumers~~the United States.

Internationally, ~~virtually~~nearly every jurisdiction inwhere ~~which~~ we operate has established its own ~~data~~privacy ~~security~~ and ~~privacy~~data ~~legal~~security framework, ~~with~~often ~~which~~more werestrictive orthan ~~our customers must comply~~U.S. ~~Laws~~laws, ~~and~~governing ~~regulations in these jurisdictions apply broadly to~~ the collection, use, storage, disclosure, and ~~security~~protection of data that identifies or ~~may~~could ~~be used to~~ identify ~~or locate~~ an individual, ~~such~~(for asexample, names, email addresses, and, in some jurisdictions, ~~Internet~~IP ~~Protocol~~ addresses). ~~These~~The ~~laws and regulations often are more restrictive than those in the United States and are rapidly evolving. For example, the~~ European Union’s ~~(“EU”)~~General ~~data~~Data ~~protection~~Protection ~~regime,~~Regulation ~~the~~ (GDPR,) ~~became~~imposes ~~enforceable~~stringent ~~on May 25~~obligations, ~~2018.~~and ~~Additionally,~~ the United Kingdom ~~("UK")~~ has ~~enacted~~implemented similar legislation. ~~that~~In ~~substantially implements the GDPR~~2025, ~~but~~ the United Kingdom’s ~~exit~~enacted ~~from~~ the EUData (~~which~~Use ~~formally~~and ~~occurred on January 31, 2020~~Access), ~~commonly~~Act ~~referred to as “Brexit~~2025,” ~~has~~which ~~created~~amends ~~uncertainty with regard to~~ the ~~regulation~~UK ofGDPR ~~data~~regime, ~~protection~~including intargeted ~~the~~changes ~~United~~related ~~Kingdom. Although there are currently various mechanisms that may be used~~ to ~~transfer~~automated ~~personal~~decision‑making, ~~data~~cookies, ~~from~~recognized ~~the~~legitimate ~~European Economic Area ("EEA") and UK to the United States in compliance with law~~interests, ~~such~~regulator ~~as the EEA standard contractual clauses~~powers, ~~the~~and ~~UK's~~international ~~International~~transfers. ~~Data~~In ~~Transfer~~December ~~Agreement / Addendum~~2025, ~~and~~ the ~~EU-U.S.~~European ~~Data~~Commission ~~Privacy~~renewed ~~Framework~~its ~~and the~~ UK ~~extension~~adequacy ~~thereto~~decisions (~~which~~subject ~~allows for transfers~~ to ~~relevant U.S.-based organizations who self-certify compliance and participate in the Framework~~review), ~~these~~supporting ~~mechanisms~~continued ~~are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal~~ data toflows ~~the~~between ~~United States. Complying with~~ the ~~GDPR~~UK or other laws, regulations or other obligations relating to privacy, data protection or information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Non-compliance could result in proceedings against us by governmental entities or others, could result in substantial fines or other liability, and ~~may~~the ~~otherwise adversely impact our business, financial condition and operating results~~EEA.

~~Some~~Cross‑border ~~statutory~~data ~~requirements,~~transfers ~~both~~from inthe European Economic Area and the UK to the United States ~~and~~rely ~~abroad,~~on ~~include~~mechanisms ~~obligations~~such ofas ~~companies~~standard tocontractual ~~notify~~clauses, ~~individuals~~the ofUK’s ~~security~~International ~~breaches~~Data ~~involving~~Transfer ~~particular~~Agreement ~~personal~~(or ~~information~~Addendum), ~~which~~and ~~could~~the ~~result~~EU–U.S. ~~from~~Data ~~breaches~~Privacy ~~experienced~~Framework by(including usits orUK ~~our~~extension). ~~service~~In ~~providers.~~September ~~Even~~2025, ~~though~~the weEuropean ~~may~~General ~~have~~Court ~~contractual~~upheld ~~protections~~the ~~with~~validity ~~our~~of ~~service~~the ~~providers~~EU–U.S. Data Privacy Framework, aproviding ~~security~~near‑term ~~breach~~stability ~~could~~for ~~impact~~organizations ~~our~~that ~~reputation,~~self‑certify ~~harm~~to ~~our~~the ~~customer~~framework; ~~confidence~~however, ~~hurt~~challenges ~~our~~and ~~sales~~appeals orremain ~~cause~~possible, usand the transfer landscape continues to ~~lose~~evolve. ~~existing~~Compliance ~~customers~~with GDPR, the UK regime as amended by the Data (Use and ~~could~~Access) ~~expose~~Act us2025, toand ~~potential~~other ~~liability~~international orprivacy laws may require ussignificant tooperational ~~expend~~changes ~~significant~~and ~~resources~~costs, onwhile ~~data~~non‑compliance ~~security~~could ~~and~~result in ~~responding~~substantial tofines, ~~such~~litigation, ~~breach.~~and reputational harm, adversely affecting our business, financial condition, and results of operations.

InCertain ~~addition~~U.S. toand ~~government~~international ~~regulation,~~laws ~~privacy~~also ~~advocates~~require ~~and~~companies ~~industry~~to ~~groups~~notify ~~may~~individuals ~~propose~~of ~~new~~security ~~and~~breaches ~~different~~involving ~~self-regulatory~~personal ~~standards~~information, ~~that~~whether ~~either~~caused ~~legally~~by us or ~~contractually~~our ~~apply~~service ~~to us~~providers. WeDespite ~~also~~contractual ~~expect~~protections, ~~that~~a ~~there~~breach ~~will~~could ~~continue~~harm toour bereputation, ~~new~~erode ~~proposed~~customer ~~laws~~trust, ~~and~~reduce ~~regulations concerning privacy~~sales, ~~data~~lead ~~protection~~to ~~and~~customer ~~information security~~loss, and weexpose ~~cannot~~us ~~yet~~to ~~determine~~liability ~~the~~or ~~impact~~significant ~~such~~remediation ~~future~~costs. ~~laws~~Beyond government regulation, ~~regulations~~privacy advocates and ~~standards~~industry groups may ~~have~~introduce onnew ~~our~~self‑regulatory ~~business.~~standards ~~New~~that ~~laws,~~could ~~amendments~~apply to orus. ~~re-interpretations~~We ofalso ~~existing~~anticipate ~~laws~~continued legislative and ~~regulations,~~regulatory ~~industry~~developments ~~standards~~in privacy, ~~contractual~~data ~~obligations~~protection, and ~~other~~information ~~obligations~~security, ~~may~~the ~~require~~impact usof towhich ~~incur~~remains ~~additional~~uncertain. ~~costs~~New ~~and~~laws, ~~restrict~~amendments, ~~our~~or ~~business~~reinterpretations ~~operations.~~of ~~Because~~existing ~~the~~requirements—as ~~interpretation~~well ~~and~~as ~~application~~evolving ofindustry ~~laws~~standards and ~~other~~contractual obligations—may ~~relating~~increase tocompliance ~~privacy~~costs and ~~data~~restrict ~~protection~~our ~~are~~operations. ~~still~~Because ~~uncertain,~~interpretation itand isenforcement ~~possible~~of ~~that~~ these ~~laws~~requirements ~~and~~are ~~other~~uncertain, ~~obligations~~they may beconflict ~~interpreted and applied in a manner that is inconsistent~~ with our ~~existing~~current ~~data management~~ practices or ~~the~~product features ~~of our software~~. If so, inwe ~~addition~~could toface ~~the possibility of~~ fines, ~~lawsuits and other claims~~litigation, weor ~~could~~ be required to ~~fundamentally~~make ~~change~~fundamental changes to our business ~~activities and practices~~ or ~~modify our~~ software, which ~~could have an adverse effect on our business. We~~ may not be ~~unable~~commercially tofeasible ~~make such changes~~ and ~~modifications~~could inlimit ~~a commercially reasonable manner or at all, and~~ our ability to ~~develop new features could be limited~~innovate. ~~Any~~Failure ~~inability~~ to adequately address privacy concerns,—whether ~~even~~valid ifor ~~unfounded,~~ perceived—or to comply with applicable ~~privacy~~requirements ~~or data protection laws, regulations and policies~~ could result in additional ~~cost~~costs, ~~and~~ liability ~~to us~~, ~~damage~~reputational ~~our reputation~~harm, ~~inhibit~~inhibited sales, and ~~adversely~~other ~~affect~~adverse effects on our business.

Furthermore, ~~the~~compliance costs ~~of compliance with,~~ and other burdens imposed by, ~~the~~privacy ~~laws, regulations~~ and ~~policies~~data ~~that~~protection ~~are~~laws applicable to ~~the businesses of~~ our customers may increase the ~~costs~~cost ~~associated~~of ~~with~~using our products, limit ~~the~~their ~~use and~~ adoption of, and reduce ~~the~~ overall demand. ~~for~~In addition, ~~our~~privacy ~~products. Privacy~~ and personal information security concerns, —whether ~~valid~~well‑founded or not ~~valid,~~ —may ~~inhibit~~discourage market ~~adoption~~acceptance of our products, particularly in certain industries and ~~foreign~~international ~~countries~~markets.

Risks Related to Our Operations

Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position.

Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including as related to financial, technology, employees, marketing, sales, etc.) which is used on a daily basis in our operations. In addition, our software involves transmission and processing of our customers’ confidential, proprietary and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. As a leader in the cyber industry, we may be an attractive target for cyber attackers or other data thieves.

High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened as a result of the number of employees working remotely due to many companies adopting a hybrid working model. Security industry experts and government officials have warned about the risks of hackers and cyberattacks targeting IT products and enterprise infrastructure. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we continue to increase our client base and expand our brand, we may become more of a target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. We may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to any cybersecurity incident or any other breach. Additionally, we use third-party service providers to provide some services to us that involve the cloud hosting, storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our IT. These actors may use a wide variety of methods, which may include developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ or customers’ data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data or loss of SaaS platform availability.

enterprise infrastructure. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we continue to increase our client base and expand our brand, we may become more of a target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. We may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to any cybersecurity incident or any other breach. Additionally, we use third-party service providers to provide some services to us that involve the cloud hosting, storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our IT. These actors may use a wide variety of methods, which may include developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ or customers’ data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data or loss of SaaS platform availability.

Security risks, including, but not limited to, unauthorized use or disclosure of customer data, loss of availability of our SaaS platform offering, cyberattack on our cloud providers, theft of proprietary information, theft of intellectual property, theft of internal employee’s PII/PHI information, theft of financial data and financial reports, loss or corruption of customer data and computer hacking attacks or other cyberattacks, could require us to expend significant capital and other resources to alleviate the problem and to improve technologies, may impair our ability to provide services to our customers and protect the privacy of their data, may result in product development delays, may compromise confidential or technical business information, may harm our competitive position, may result in theft or misuse of our intellectual property or other assets and could expose us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after a breach or other incident, and other liabilities. We are continuously working to improve our IT systems, together with creating security boundaries around our critical and sensitive assets. We provide advanced security awareness training to our employees and contractors that focuses on various aspects of the cybersecurity world. All of these steps are taken in order to mitigate the risk of attack and to ensure our readiness to responsibly handle any security violation or attack. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures and our products could be harmed, we could lose potential sales and existing customers, our ability to operate our business could be impaired, we may incur significant liabilities, we could suffer harm to our reputation and competitive position, and our operating results could be negatively impacted.

The expansion of cloud-delivered services introduces a number of risks and uncertainties, which could adversely affect our business, results of operations and financial condition.

The launch of our cloud offerings that allow customers to use hosted software required, and any future expansion of our cloud-delivered services may require, a considerable investment in resources, including technical, financial, legal, sales, information technology and operation systems. Additionally, market acceptance of such offerings is affected by a variety of factors, including but not limited to: security, reliability, scalability, customization, performance, current license terms, customer preference, customer concerns with entrusting a third-party to store and manage their data, public concerns regarding privacy and the enactment of restrictive laws or regulations. It is possible that demand for our cloud offerings may not continue to be as strong as it has been to date. Moreover, expansion of our cloud offerings may cause a decline in revenue of our existing products and services that is not offset by revenue from the new products or services. For example, customers may delay making purchases of products and services to permit them to make a more thorough evaluation of these new products and services or until industry and marketplace reviews become widely available. We may be unable to realize the benefits of our investments or the resources we have committed to expanding our cloud-delivered services.

services or until industry and marketplace reviews become widely available. We may be unable to realize the benefits of our investments or the resources we have committed to expanding our cloud-delivered services.

An increasing number of jurisdictions are imposing data localization laws, which require personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. These regulations may deter customers from using cloud-based services, and may inhibit our ability to expand into certain markets or prohibit us from continuing to offer services in those markets without significant additional costs.

Our hosted offerings rely upon third-party providers to supply data center space, equipment maintenance and other colocation services and rely upon the ability of those providers to maintain continuous service availability and protect customer data on their services. Customers of our cloud-based offerings need to be able to access our platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. Although we have entered into various agreements for the lease of data center space, equipment maintenance and other services, third parties could fail to live up to their contractual obligations. The failure of a third-party provider to prevent service disruptions, data losses or security breaches may require us to issue credits or refunds or indemnify or otherwise be liable to customers or third parties for damages that may occur, and contractual provisions with our third-party providers and public cloud partners may limit our recourse against the third-party provider or public cloud partner responsible for such failure. Additionally, if these third-party providers fail to deliver on their obligations, our reputation could be damaged, our customers could lose confidence in us, and our ability to maintain and expand our hosted offerings would be impaired. Lastly, our cloud product offering and pricing is new and hosting and other costs may be more expensive to us than anticipated.

~~We may not be able to predict renewal rates and their impact on our future revenues and operating results.~~13

~~Although~~their services. Customers of our ~~solutions~~cloud-based ~~are~~offerings ~~designed~~need to ~~increase~~be ~~the~~able ~~number~~to ofaccess ~~customers~~our ~~that~~platform ~~purchase~~at ~~our~~any ~~products~~time, ~~and~~without ~~the~~interruption ~~number~~or degradation of ~~products~~performance, ~~purchased~~and bywe ~~existing~~provide ~~and~~them ~~new~~with ~~customers~~service tolevel ~~create~~commitments awith ~~recurring~~respect ~~revenue~~to ~~stream~~uptime. ~~that~~Third-party ~~increases~~cloud ~~and~~providers isrun ~~more~~their ~~predictable~~own ~~over~~platforms ~~time~~that we access, ~~our~~and ~~customers~~we are, ~~not~~therefore, ~~required~~vulnerable to ~~renew~~ their ~~subscriptions~~service ~~for~~interruptions. ~~our~~Although ~~solutions~~we ~~and~~have ~~they~~entered ~~may~~into ~~elect~~various ~~not~~agreements tofor ~~renew~~the ~~when,~~lease orof asdata wecenter ~~expect~~space, orequipment ~~they~~maintenance ~~may~~and ~~elect~~other toservices, ~~reduce~~third ~~the~~parties ~~scope~~could offail ~~their~~to ~~original~~live ~~purchases~~up orto ~~delay~~ their ~~purchase~~contractual obligations. WeThe ~~cannot~~failure ~~accurately~~of ~~predict~~a ~~renewal~~third-party ~~rates~~provider ~~given~~to ~~our~~prevent ~~varied~~service ~~customer~~disruptions, ~~base~~data oflosses ~~enterprise~~or ~~and~~security ~~small~~breaches ~~and~~may ~~medium~~require ~~size~~us ~~business~~to ~~customers~~issue ~~and~~credits ~~the~~or ~~number~~refunds ofor ~~multiyear~~indemnify ~~contracts.~~or ~~Customer~~otherwise ~~renewal~~be ~~rates~~liable ~~may~~to ~~decline~~customers or ~~fluctuate~~third ~~due~~parties tofor adamages ~~number~~that ofmay ~~factors~~occur, ~~including~~and ~~offering~~contractual ~~pricing,~~provisions ~~competitive~~with ~~offerings,~~our ~~customer~~third-party ~~satisfaction~~providers and ~~reductions~~public incloud ~~customer~~partners ~~spending~~may ~~levels~~limit orour ~~customer~~recourse ~~activity~~against ~~due~~the tothird-party ~~economic~~provider ~~downturns,~~or ~~the~~public ~~adverse~~cloud ~~impact~~partner ofresponsible ~~import~~for ~~tariffs~~such failure. Additionally, ~~inflation~~if orthese ~~other~~third-party ~~market~~providers ~~uncertainty.~~fail Ifto deliver on their obligations, our ~~customers~~reputation docould ~~not~~be ~~renew~~damaged, ~~their~~our ~~contracts~~customers ~~when~~could orlose asconfidence wein ~~expect~~us, orand ifour ~~they~~ability ~~choose~~ to ~~renew~~maintain ~~for~~and ~~fewer~~expand ~~products~~our orhosted ~~renew~~offerings ~~for~~would ~~shorter~~be ~~contract~~impaired. ~~lengths~~Lastly, orour ifcloud ~~they~~product ~~renew~~offering onand ~~less~~pricing ~~favorable~~is ~~terms,~~new ~~our~~and ~~revenues~~hosting and ~~earnings~~other costs may ~~decline,~~be ~~and~~more ~~our~~expensive ~~business~~to ~~may~~us ~~suffer~~than anticipated.

We may not be able to predict renewal or conversion rates and their impact on our future revenues and operating results.

Although our solutions are designed to increase the number of customers that purchase our products and the number of products purchased by existing and new customers to create a recurring revenue stream that increases and is more predictable over time, our customers are not required to renew their subscriptions for our solutions and they may elect not to renew when, or as we expect, or they may elect to reduce the scope of their original purchases or delay their purchase. We cannot accurately predict renewal or conversion rates given our varied customer base of enterprise and small and medium size business customers and the number of multiyear contracts. Customer renewal or conversion rates may decline or fluctuate due to a number of factors, including offering pricing, competitive offerings, customer satisfaction and reductions in customer spending levels or customer activity due to economic downturns, the adverse impact of import tariffs, inflation or other market uncertainty. If our customers do not renew their contracts when or as we expect, or if they choose to renew for fewer products or renew for shorter contract lengths or if they renew on less favorable terms, our revenues and earnings may decline, and our business may suffer. Further, we plan to end-of-life our self-hosted business as of December 31, 2026, which we expect to increase the uncertainty with our remaining term license customers going forward. This may result in a decline in revenues and cause revenues to be more difficult to predict for a period of time. We may occasionally inform customers that products or services will be reaching their end-of-life and will no longer be supported or receive updates or security patches. Failure to effectively manage this process could lead to customer dissatisfaction and contractual liabilities, which could adversely affect our business and operating results.

Our quarterly results of operations have fluctuated and may fluctuate significantly due to variability in our revenues which could adversely impact our stock price.

Our revenues and other results of operations have fluctuated from quarter to quarter in the past and could continue to fluctuate in the future. Historically, the fluctuation was partially due to the front-loaded revenue recognition nature of our business. Additionally, the Company ishas ~~currently~~converted ~~transitioning~~the significant majority of its customers to a SaaS delivery model that recognizes revenue ratably and ~~we do~~ not up front~~-load~~. ~~revenue~~However, ~~with~~there ~~respect~~are still a number of term license subscriptions remaining to ~~those~~be ~~purchases.~~converted Asand, as a result, we may present reduced revenues as compared to prior periods, and comparing our revenues and results of operations on a period-to-period basis may not be meaningful, and should not be relied on for any particular period. Our revenues depend in part on the conversion of enterprises that have undergone risk assessments into paying customers; however, these risk assessments may not be converted at the same historical rates or at all. At the same time, the majority of our sales are typically made during the last three weeks of every quarter. We may fail to meet market expectations for that quarter if we are unable to close the number of transactions that we expect during this short period and closings are deferred to a subsequent quarter or not closed at all. The closing of a large transaction in a particular quarter may raise our revenues in that quarter and thereby make it more difficult for us to meet market expectations in subsequent quarters and our failure to close a large transaction in a particular quarter or any renewals may adversely impact our revenues in that quarter. In addition, our sales cycle from initial contact to delivery of and payment for the software license generally becomes longer and less predictable with respect to large transactions and often involves multiple meetings or consultations at a substantial cost and time commitment to us. Further, we ~~recently~~have ~~began~~been focusing on the conversion of our current OPS customers to our SaaS platform and the sales cycle of such conversions can and may continue to take longer than the acquisition of new customers. Moreover, we base our current and future expense levels on our revenue forecasts and operating plans, and our expenses are relatively fixed in the short-term. Accordingly, we would likely not be able to reduce our costs sufficiently to compensate for an unexpected shortfall in revenues and even a relatively small decrease in revenues could disproportionately and adversely affect our financial results for that quarter.

The variability and unpredictability of these and other factors, many of which are outside of our control, could result in our failing to meet or exceed financial expectations for a given period and may cause the price of our common stock to decline substantially.

~~If the transition to a SaaS delivery model fails to yield the benefits that we expect, our results of operations could be negatively impacted.~~14

WeIf ~~successfully~~we ~~completed~~do ~~our~~not ~~transition~~successfully tooptimize ~~a subscription-based business model~~ and ~~are~~manage ~~currently transitioning~~ our ~~business~~predominantly ~~to a~~ SaaS‑based ~~delivery~~business model., Itor isif ~~uncertain~~the ~~whether~~remaining ~~this~~ transition ~~will~~away ~~prove~~from ~~successful.~~self‑hosted ~~Market acceptance of our~~ products isfails ~~dependent on our ability~~ to ~~include~~progress ~~functionality~~as ~~and usability that address certain customer requirements. Additionally~~expected, ~~we must optimally price~~ our ~~products~~results ~~in light~~ of ~~marketplace~~operations ~~conditions,~~could ~~our~~be ~~costs~~negatively ~~and customer demand~~impacted. ~~This transition may have negative revenue and earnings implications, including on our quarterly results of operations.~~

~~This~~As our business is now substantially SaaS‑focused, ~~strategy~~our ~~may~~future ~~give~~performance ~~rise~~depends heavily on our ability to aeffectively ~~number~~operate, scale, and continuously improve our SaaS offerings. Although customer adoption of ~~risks~~our SaaS solutions has increased significantly, ~~including~~uncertainties remain regarding whether and when our remaining self‑hosted customers will convert and the ~~following:~~degree to which our SaaS offerings will continue to meet evolving customer expectations for functionality, reliability, security, and value.

~~•our~~This ~~revenues~~SaaS ~~and~~strategy ~~operating~~continues ~~margins~~to ~~may~~pose ~~fluctuate~~a ~~more~~number ~~than~~of ~~anticipated~~risks, ~~over~~including the ~~short-term as a result of this strategy;~~following:

•ifour ~~current~~revenues ~~customers~~and ~~desire~~operating ~~only~~margins ~~self-hosted~~may ~~licenses~~fluctuate more than anticipated as our ~~SaaS~~business ~~sales~~model relies increasingly on subscription revenues, which may ~~lag~~be ~~behind~~more ~~our~~sensitive ~~expectations~~to renewal rates, customer usage patterns, and macroeconomic conditions;

•the ~~shift~~remaining toself‑hosted acustomer ~~SaaS~~base ~~strategy~~ may ~~raise~~convert ~~concerns~~more ~~among~~slowly ~~our~~than ~~customer base~~projected, ~~including~~or ~~concerns~~certain ~~regarding~~customers ~~changes~~may choose not to ~~pricing~~transition ~~over~~at ~~time~~all, ~~and~~which ~~access~~could toreduce ~~data~~expected ~~once~~growth aor ~~subscription~~require ~~has~~continuing ~~expired~~investment in legacy offerings;

•wecustomers may becontinue ~~unsuccessful~~to inexpress ~~maintaining~~concerns orrelated ~~implementing~~to ~~our~~long‑term ~~target~~ pricing, ordata ~~new pricing models~~access, ~~product~~data ~~adoption and projected renewal rates~~residency, or wevendor ~~may~~lock‑in, ~~select~~which ~~a target price or new pricing model that is not optimal and~~ could ~~negatively~~ affect ~~our~~new subscription sales or ~~earnings~~renewal rates;

•ifwe ~~our~~may ~~customers~~be dounsuccessful ~~not~~in ~~renew~~maintaining ~~their subscriptions~~ or doadjusting ~~not~~our ~~renew~~pricing ~~them~~models, onproduct atiers, ~~timely~~or ~~basis~~packaging strategies, ~~our~~or ~~revenues~~such changes may ~~decline~~adversely ~~and~~affect ~~our~~customer ~~business~~adoption, ~~may~~demand, ~~suffer~~or earnings;

•weif ~~may~~our ~~incur~~customers ~~hosting~~do ~~costs~~not atrenew atheir ~~higher~~subscriptions, ~~than~~reduce ~~forecasted~~usage, ~~rate~~ or delay renewal decisions, our ~~SaaS~~revenues ~~platform~~may ~~can~~decline ~~operate~~and ~~less~~our ~~efficiently~~business ~~than~~and ~~anticipated~~operating results may suffer;

•weour ~~may~~hosting, ~~incur~~infrastructure, ~~sales~~or ~~compensation~~third‑party cloud costs atmay aexceed ~~higher~~forecasts, ~~than~~or ~~forecasted~~our ~~rate~~SaaS ifplatform ~~the~~may ~~pace~~not ofscale ~~our~~or ~~subscription~~operate ~~transition~~as isefficiently ~~faster~~as ~~than~~ anticipated;, ~~and~~negatively affecting gross margins;

•~~our~~we ~~sales~~may ~~force~~incur ~~may~~higher ~~struggle~~than ~~with~~expected sales compensation expenses if the ~~transition~~pace ~~which~~of ~~may~~remaining ~~lead~~conversions toor ~~increased~~new ~~turnover~~SaaS ~~rates~~sales ~~and~~varies ~~lower~~from ~~headcount.~~forecasted levels; and

•our sales force and customer facing teams may face ongoing challenges with selling and supporting SaaS solutions, which may lead to productivity issues, increased turnover, or the need for additional training and investment.

If we fail to effectively manage or optimize our SaaS‑focused operating model, or if customer adoption, retention, or conversion does not continue at expected levels, our revenues, margins, and overall results of operations could suffer.

Our results of operations could be negatively affected by foreign currency exposures.

Our functional and reporting currency is the U.S. dollar. While the majority of our revenues and expenses are denominated in U.S. dollars, we also generate revenues and incur operating expenses in foreign currencies, primarily the Euro, British Pound, Canadian dollar, Australian dollar, Singapore dollar and New Israeli Shekel. As a result, our operating results are exposed to movements in foreign currency exchange rates.

Exchange rates between the U.S. dollar and foreign currencies have been volatile in recent years. In addition, based on our current geographic revenue mix, cost structure and expected growth profile, even if foreign exchange rates remain at or near current levels, we expect to experience foreign currency‑related headwinds in future periods, which could adversely affect our reported revenues, operating margins and results of operations.

A strengthening of the U.S. dollar relative to foreign currencies may increase the local‑currency cost of our software and renewals for customers outside the United States and may adversely affect demand, pricing, renewal rates and revenue growth. At the same time, a weakening of the U.S. dollar against currencies in which we incur expenses would increase the U.S. dollar equivalent of those costs, including employee compensation and other operating expenses at our non‑U.S. locations, which could negatively impact operating margins and increase compensation pressure in those regions.

We use foreign currency forward contracts to hedge a portion of our exposure to foreign‑currency‑denominated revenues and operating expenses. These hedging activities may not fully offset the impact of current or future exchange rate movements and involve costs and risks, including cash requirements, management time and resources, external implementation costs, potential accounting impacts and the risk of losses resulting from volatility in foreign currency markets or differences between the exchange rates of the currencies being hedged. As a result, our results of operations and financial condition may be adversely affected by foreign exchange rate movements even if exchange rates remain stable.

We have been growing and expect to continue to invest in our growth for the foreseeable future. If we fail to manage this growth effectively, our business and results of operations will be adversely affected.

We intend to continue to grow our business and plan to continue to hire new sales employees either for expansion or replacement of existing sales personnel. If we cannot adequately and timely hire new employees and if we fail to adequately train these new employees, including our sales force, engineers and customer support staff, our sales may not grow at the rates we project and/or our sales productivity might suffer, our customers might decide not to renew or reduce the scope of their original purchases, or our customers may lose confidence in the knowledge and capability of our employees or products. We must successfully manage our growth to achieve our objectives. Although our business has experienced significant growth in the past, we may not be able to continue to grow at the same rate, or at all.

Our ability to effectively manage any significant growth of our business will depend on a number of factors, including our ability to do the following:

• satisfy existing customers and attract new customers;

• adequately and timely recruit, train, motivate and integrate new employees, including our sales force and engineers, while retaining existing employees, maintaining the beneficial aspects of our corporate culture and effectively executing our business plan;

• successfully introduce new products and enhancements;

• effectively manage existing channel partnerships and expand to new ones;

• improve our key business applications and processes to support our business needs;

• enhance information and communication systems to ensure that our employees and offices around the world are well-coordinated and can effectively communicate with each other and our growing customer base;

• enhance our internal controls to ensure timely and accurate reporting of all of our operations and financial results;

• protect and further develop our strategic assets, including our intellectual property rights;

• continue to capitalize on the transition to a SaaS delivery model; and

• successfully manage and integrate any future acquisitions of businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies.

These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure. We may not be able to grow our business in an efficient or timely manner, or at all. Moreover, if we do not effectively manage the growth of our business and operations, the quality of our software could suffer, which could negatively affect our brand, results of operations and overall business.

We have a limited operating history at our current scale, which makes it difficult to evaluate and predict our future prospects and may increase the risk that we will not be successful.

We have a relatively short history operating our business at its current scale. For example, we have increased the number of our employees and have expanded our operations and product offerings. This limits our ability to forecast our future operating results and subjects us to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in new markets that may not develop as expected. Because we depend in part on the market’s acceptance of our products, it is difficult to evaluate trends that may affect our business. If our assumptions regarding these trends and uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. Moreover, although we have experienced significant growth historically, we may not continue to grow as quickly, or at all, in the future.

Our future success will depend in large part on our ability to, among other things:

• ~~successfully~~convert ~~transition~~our toremaining aself-hosted ~~SaaS~~customers ~~delivery~~to ~~model and manage~~ our ~~introduction~~SaaS ofdelivery ~~cloud-based solutions~~model;

•manage our introduction of cloud-based solutions;

• maintain and expand our business, including our customer base and operations, to support our growth, both domestically and internationally;

• develop new products and services and bring products and services in beta to market;

• renew customer agreements and sell additional products to existing customers;

• maintain high customer satisfaction and ensure quality and timely releases of our products and product enhancements;

• increase market awareness of our products and enhance our brand;

• maintain compliance with applicable governmental regulations and other legal obligations, including those related to intellectual property, international sales and taxation;

• hire, integrate, train and retain skilled talent, including members of our sales force and engineers; and

• our ability to successfully manage and integrate any acquisitions of businesses.

If we fail to address the risks and difficulties that we face, including those associated with the challenges listed above as well as those described elsewhere in this “Risk Factors” section, our business will be adversely affected, and our results of operations will suffer.

If we are unable to attract new customers and expand sales to existing customers, both domestically and internationally, our growth could be slower than we expect, and our business may be harmed.

Our success will depend, in part, on our ability to support new and existing customer growth and maintain customer satisfaction. Our sales and marketing teams host in-person events and engage with customers online and through other communications channels, including virtual meetings. Our sales and marketing teams may not be as successful or effective in building relationships. If we cannot provide the tools and training to our teams to efficiently do their jobs and satisfy customer demands, we may not be able to achieve anticipated revenue growth as quickly as expected.

Our future growth depends upon expanding sales of our products to existing customers and their organizations and receiving renewals. If our customers do not purchase additional products or capabilities, our revenues may grow more slowly than expected, may not grow at all or may decline. Our efforts may not result in increased sales to existing customers (“upsells”) and additional revenues. If our efforts to upsell to our customers are not successful, our business would suffer.

Our future growth also depends in part upon increasing our customer base, particularly those customers with potentially high customer lifetime values. Our ability to achieve significant growth in revenues in the future will depend, in large part, upon the effectiveness of our sales and marketing efforts, both domestically and internationally, and our ability to attract new customers. Our ability to attract new customers may be adversely affected by newly enacted laws that may prohibit certain sales and marketing activities, such as legislation passed in the State of New York, pursuant to which unsolicited telemarketing sales calls are prohibited. If we fail to attract new customers and maintain and expand those customer relationships, our revenues may be adversely affected, and our business will be harmed.

We have a history of losses, and we may not be profitable in the future.

18We have incurred net losses in each year since our inception, including a net loss of $129.3 million, $95.8 million and $100.9 million in each of the years ended December 31, 2025, 2024 and 2023, respectively. Because the market for our software is rapidly evolving and has still not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we hire additional personnel, expand and improve the effectiveness of our distribution channels, and continue to develop features and applications for our software.

We have incurred net losses in each year since our inception, including a net loss of $95.8 million, $100.9 million and $124.5 million in each of the years ended December 31, 2024, 2023 and 2022, respectively. Because the market for our software is rapidly evolving and has still not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we hire additional personnel, expand and improve the effectiveness of our distribution channels, and continue to develop features and applications for our software.

If we are unable to maintain successful relationships with our channel partners, our business could be adversely affected.

We rely on channel partners, such as distribution partners and resellers, to sell the Varonis Data Security Platform. In ~~2023~~2024 and ~~2024~~2025, our channel partners fulfilled substantially all of our sales, and we expect that sales to channel partners will continue to account for substantially all of our revenues for the foreseeable future. Our ability to achieve revenue growth in the future will depend in part on our success in maintaining successful relationships with our channel partners.

Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers the products of several different companies. If our channel partners do not effectively market and sell our software, choose to use greater efforts to market and sell their own products or those of others, or fail to meet the needs of our customers, our ability to grow our business, sell our software and maintain our reputation may be adversely affected. Our contracts with our channel partners generally allow them to terminate their agreements for any reason upon 30 days’ notice. A termination of the agreement has no effect on orders already placed. The loss of a substantial number of our channel partners, our possible inability to replace them, or the failure to recruit additional channel partners could materially and adversely affect our results of operations. If we are unable to maintain our relationships with these channel partners, our business, results of operations, financial condition or cash flows could be adversely affected.

Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products or increased revenue.

Our long-term growth depends, in part, on being able to continue to expand internationally on a profitable basis, which subjects us to risks associated with conducting international operations.

Historically, we have generated the majority of our revenues from customers in the United States. For the years ended December 31, ~~2024~~2025 and ~~2023~~2024, approximately 7371% and 7273%, respectively, of our total revenues were derived from sales in the United States. Nevertheless, we have operations across the globe, and we plan to continue to expand our international operations as part of our long-term growth strategy. The further expansion of our international operations will subject us to a variety of risks and challenges, including:

United States. Nevertheless, we have operations across the globe, and we plan to continue to expand our international operations as part of our long-term growth strategy. The further expansion of our international operations will subject us to a variety of risks and challenges, including:

• sales and customer service challenges associated with operating in different countries;

• increased management travel, infrastructure and legal compliance costs associated with having multiple international operations;

• difficulties in receiving payments from different geographies, including difficulties associated with currency fluctuations, payment cycles, transfer of funds or collecting accounts receivable, especially in emerging markets;

• variations in economic or political conditions between each country or region;

• economic uncertainty around the world and adverse effects arising from economic interdependencies across countries and regions;

• uncertainty around a potential reverse or renegotiation of international trade agreements and partnerships;

• compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations;

• ability to hire, retain and train local employees and the ability to comply with foreign labor laws and local labor requirements, such as representations by an internal labor committee in France which is affiliated with an external trade union and the applicability of collective bargaining arrangements at the national level in certain European countries;

• compliance with laws and regulations for foreign operations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.K. Bribery Act of 2010 (the “UK Bribery Act”), import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our software in certain foreign markets, and the risks and costs of non-compliance;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements;

• reduced protection for intellectual property rights in certain countries and practical difficulties and costs of enforcing rights abroad; and

• compliance with the laws of numerous foreign taxing jurisdictions and overlapping of different tax regimes and digital tax imposed on our operations in foreign taxing jurisdictions.

Any of these risks could adversely affect our international operations, reduce our revenues from outside the United States or increase our operating costs, adversely affecting our business, results of operations and financial condition and growth prospects. There can be no assurance that all of our employees, independent contractors and channel partners will comply with the formal policies we have and will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, independent contractors and channel partners could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our software and services and could have a material adverse effect on our business and results of operations.

We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

We incorporate certain encryption technology into certain of our products and, as a result, are required to comply with U.S. export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”). We are also subject to Israeli export control laws on encryption technology. These export control laws and regulations prohibit, restrict, or regulate our ability to, directly or indirectly, export, re-export, or transfer certain products to certain countries and territories, entities, and individuals for certain end uses. If the applicable U.S. or Israeli legal requirements regarding the export of encryption technology were to change or if we change the encryption means in our products, we may (i) be unable to export our products, (ii) need to apply for new licenses or (iii) be unable to rely on certain license exceptions. Furthermore, various other countries regulate the import of certain encryption technology, including import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

We are also subject to U.S. and Israeli economic sanctions laws, which prohibit the shipment of certain products to embargoed or sanctioned countries, sanctioned governments and sanctioned persons. Like with export controls, we take precautions to prevent our products from being provided in violation of these laws, including requiring our business partners to commit to compliance through contractual undertakings. However, if our business partners were to provide our products to certain countries, governments, or sanctioned persons in violation of these laws, such provision could have negative consequences, including government investigations, penalties and reputational harm.

Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

Our business in countries with a history of corruption and transactions with foreign governments increase the risks associated with our international activities.

As we operate and sell internationally, we are subject to the FCPA, the UK Bribery Act and other laws that prohibit improper payments or offers of payments to foreign governments and their officials and political parties for the purpose of obtaining or retaining business. We have operations, deal with and make sales to governmental customers in countries known to experience corruption, particularly certain emerging countries in Eastern Europe, South and Central America, East Asia, Africa and the Middle East. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees, consultants, channel partners or sales agents that could be in violation of various anti-corruption laws, even though these parties may not be under our control. While we have implemented safeguards to prevent these practices by our employees, consultants, channel partners and sales agents, our existing safeguards and any future improvements may prove to be less than effective, and our employees, consultants, channel partners or sales agents may engage in conduct for which we might be held responsible. Violations of the FCPA or other anti-corruption laws may result in severe criminal or civil sanctions, including suspension or debarment from government contracting, and we may be subject to other liabilities, which could negatively affect our business, operating results and financial condition.

Acquisitions could disrupt our business and adversely affect our results of operations, financial condition and cash flows.

As we continue to pursue business opportunities, we may make acquisitions that could be material to our business, results of operations, financial condition and cash flows. Acquisitions involve many risks, including the following:

• an acquisition may negatively affect our results of operations, financial condition or cash flows because it may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, including potential write-downs of deferred revenues, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to the acquisition;

• we may encounter difficulties or unforeseen expenditures in integrating the business, technologies, products, personnel or operations of any company that we acquire, particularly if key personnel of the acquired company decide not to work for us;

• an acquisition may disrupt our ongoing business, divert resources, increase our expenses and distract our management;

• an acquisition may result in a delay or reduction of customer purchases for both us and the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;

• we may encounter difficulties in, or may be unable to, successfully sell any acquired products;

• an acquisition may involve the entry into geographic or business markets in which we have little or no prior experience or where competitors have stronger market positions;

• challenges inherent in effectively managing an increased number of employees in diverse locations;

• the potential strain on our financial and managerial controls and reporting systems and procedures;

• potential known and unknown liabilities or deficiencies associated with an acquired company that were not identified in advance;

• our use of cash to pay for acquisitions would limit other potential uses for our cash and affect our liquidity;

• if we incur debt to fund such acquisitions, such debt may subject us to material restrictions on our ability to conduct our business as well as financial maintenance covenants;

• the risk of impairment charges related to potential write-downs of acquired assets or goodwill in future acquisitions;

• to the extent that we issue a significant amount of equity or convertible debt securities in connection with future acquisitions, existing stockholders may be diluted and earnings per share may decrease; and

• managing the varying intellectual property protection strategies and other activities of an acquired company.

We may not succeed in addressing these or other risks or any other problems encountered in connection with the integration of any acquired business. Our ability as an organization to successfully acquire and integrate technologies or businesses is limited. The inability to successfully integrate the business, technologies, products, personnel or operations of any acquired business, or any significant delay in achieving integration, could have a material adverse effect on our business, results of operations, financial condition and cash flows.

We are exposed to collection and credit risks, which could impact our operating results.

Our trade receivables are subject to collection and credit risks. These agreements may include purchase commitments for multiple years of SaaS and term license subscriptions ~~and SaaS~~, which may be invoiced over multiple reporting periods increasing these risks. For example, our operating results may be impacted by significant bankruptcies among customers and resellers, which could negatively impact our revenues and cash flows. Although we have processes in place that are designed to monitor and mitigate these risks, we cannot guarantee these programs will be effective. If we are unable to adequately control these risks, our business, operating results and financial condition could be harmed.

If currency exchange rates fluctuate substantially in the future, our results of operations, which are reported in U.S. dollars, could be adversely affected.

Our functional and reporting currency is the U.S. dollar, and we generate the majority of our revenues and incur the majority of our expenses in U.S. dollars. Revenues and expenses are also incurred in other currencies, primarily Euros, Pounds Sterling, Canadian dollars, Australian dollars, Singapore dollar and the New Israeli Shekel. Accordingly, changes in exchange rates may have a material adverse effect on our business, results of operations and financial condition. The exchange rates between the U.S. dollar and foreign currencies have fluctuated substantially in recent years and may continue to fluctuate substantially in the future. Furthermore, a strengthening of the U.S. dollar could increase the cost in local currency of our software and renewals to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows.

We incur expenses for employee compensation and other operating expenses at our non-U.S. locations in local currencies. The weakening of the U.S. dollar against such currencies would cause the U.S. dollar equivalent of such expenses to increase which could have a negative impact on our reported results of operations and our ability to attract employees in such non-U.S. locations due to the actual increase in the compensation to be paid to such employees. We use forward foreign exchange contracts to hedge or mitigate the effect of changes in foreign exchange rates on our revenues and operating expenses denominated in certain foreign currencies. However, this strategy might not eliminate our exposure to foreign exchange rate fluctuations and involves costs and risks of its own, such as cash expenditures, ongoing management time and expertise, external costs to implement the strategy and potential accounting implications. Additionally, our hedging activities may contribute to increased losses as a result of volatility in foreign currency markets and the difference between the interest rates of the currencies being hedged.

Our business is highly dependent upon our brand recognition and reputation, and the failure to maintain or enhance our brand recognition or reputation may adversely affect our business.

We believe that enhancing the “Varonis” brand identity and maintaining our reputation in the IT industry is critical to our relationships with our customers and to our ability to attract new customers. Our brand recognition and reputation are dependent upon:

• our ability to continue to offer high quality, innovative and error- and bug-free products;

• our ability to maintain customer satisfaction with our products;

• our ability to be responsive to customer concerns and provide high quality customer support, training and professional services;

• our marketing efforts;

• any misuse or perceived misuse of our products;

• positive or negative publicity;

• our ability to prevent or quickly react to any cyberattack on our IT systems or security breach of or related to our software;

• interruptions, delays or attacks on our website; and

• litigation or regulatory-related developments.

We may not be able to successfully promote our brand or maintain our reputation. In addition, independent industry analysts often provide reviews of our products, as well as other products available in the market, and perception of our product in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive than reviews about other products available in the market, our brand may be adversely affected. Furthermore, negative publicity relating to events or activities attributed to us, our employees, our channel partners or others associated with any of these parties, may tarnish our reputation and reduce the value of our brand. If we do not successfully enhance our brand and maintain our reputation, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers or renewals, all of which would adversely affect our business, operations and financial results. Moreover, damage to our reputation and loss of brand equity may reduce demand for our products and have an adverse effect on our business, results of operations and financial condition. Any attempts to rebuild our reputation and restore the value of our brand may be costly and time consuming, and such efforts may not ultimately be successful.

Moreover, it may be difficult to enhance our brand and maintain our reputation in connection with sales to channel partners. Promoting our brand requires us to make significant expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new markets and geographies and as more sales are generated to our channel partners. To the extent that these activities yield increased revenues, these revenues may not offset the increased expenses we incur.

Our success depends in part on maintaining, converting to SaaS and increasing our sales to customers in the public sector.

We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government-owned or -controlled entities (such as public health care bodies, educational institutions and utilities), which we refer to as the public sector herein. We believe that part of the success and growth of our business will continue to depend on our successful procurement of public sector contracts. Selling to public sector entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that our efforts will produce any sales. Government demand and payment for our products and services may be impacted by public sector budgetary cycles, or lack of, and funding authorizations, including in connection with an extended government shutdown, with funding reductions or delays adversely affecting public sector demand for our products and services. Factors that could impede our ability to maintain or increase the amount of revenues derived from public sector contracts include:

• changes in public sector fiscal or contracting policies;

• decreases or elimination of available public sector funding;

• non-compliance with or an inability to attain the proper certification to conduct business in the public sector;

• changes in public sector programs or applicable requirements;

• the adoption of new laws or regulations or changes to existing laws or regulations;

• potential delays or changes in the public sector appropriations or other funding authorization processes;

• the requirement of contractual terms that are unfavorable to us, such as most-favored-nation pricing provisions; and

• delays in the payment of our invoices by public sector payment offices.

In addition, we must comply with laws and regulations relating to public sector contracting, which affect how we and our channel partners do business in both the United States and abroad. These laws and regulations may impose added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to claims for damages from our channel partners, penalties, termination of contracts, and temporary suspension or permanent debarment from public sector contracting. Moreover, governments may investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our products, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit uncovers improper or illegal activities.

Furthermore, on January 20, 2025, President Donald J. Trump announced an executive order establishing the “Department of Government Efficiency” to maximize government efficiency and productivity. Pressures on and uncertainty surrounding the U.S. federal government’s budget and potential changes in budgetary priorities, could adversely affect the funding for individual programs and delay purchasing decisions by our customers.

The occurrence of any of the foregoing could cause public sector customers to delay or refrain from purchasing licenses of our software in the future or otherwise have an adverse effect on our business, operations and financial results.

Filing Compare · VARONIS SYSTEMS INC